util-vserver/src/chcontext.c

   1 // $Id$
   2
   3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
   4 // based on chcontext.cc by Jacques Gelinas
   5 //
   6 // This program is free software; you can redistribute it and/or modify
   7 // it under the terms of the GNU General Public License as published by
   8 // the Free Software Foundation; either version 2, or (at your option)
   9 // any later version.
  10 //
  11 // This program is distributed in the hope that it will be useful,
  12 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 // GNU General Public License for more details.
  15 //
  16 // You should have received a copy of the GNU General Public License
  17 // along with this program; if not, write to the Free Software
  18 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19
  20 /*
  21         chcontext is a wrapper to user the new_s_context system call. It
  22         does little more than mapping command line option to the system call
  23         arguments.
  24 */
  25 #ifdef HAVE_CONFIG_H
  26 #  include <config.h>
  27 #endif
  28 #include "compat.h"
  29
  30 #include <stdio.h>
  31 #include <unistd.h>
  32 #include <string.h>
  33 #include <stdlib.h>
  34 #include <errno.h>
  35
  36 #include "vserver.h"
  37
  38 static void usage()
  39 {
  40         fprintf (stderr,"chcontext version %s\n",VERSION);
  41         fprintf (stderr
  42                 ,"chcontext [ options ] command arguments ...\n"
  43                  "\n"
  44                  "chcontext allocate a new security context and executes\n"
  45                  "a command in that context.\n"
  46                  "By default, a new/unused context is allocated\n"
  47                  "\n"
  48
  49                  "--cap CAP_NAME\n"
  50                  "\tAdd a capability from the command. This option may be\n"
  51                  "\trepeated several time.\n"
  52                  "\tSee /usr/include/linux/capability.h\n"
  53                  "\tIn general, this option is used with the --secure option\n"
  54                  "\t--secure removes most critical capabilities and --cap\n"
  55                  "\tadds specific ones.\n"
  56                  "\n"
  57
  58                  "--cap !CAP_NAME\n"
  59                  "\tRemove a capability from the command. This option may be\n"
  60                  "\trepeated several time.\n"
  61                  "\tSee /usr/include/linux/capability.h\n"
  62                  "\n"
  63                  "--ctx num\n"
  64                  "\tSelect the context. On root in context 0 is allowed to\n"
  65                  "\tselect a specific context.\n"
  66                  "\tContext number 1 is special. It can see all processes\n"
  67                  "\tin any contexts, but can't kill them though.\n"
  68                  "\tOption --ctx may be repeated several times to specify up to 16 contexts.\n"
  69
  70                  "--disconnect\n"
  71                  "\tStart the command in background and make the process\n"
  72                  "\ta child of process 1.\n"
  73
  74                  "--domainname new_domainname\n"
  75                  "\tSet the domainname (NIS) in the new security context.\n"
  76                  "\tUse \"none\" to unset the domain name.\n"
  77
  78                  "--flag\n"
  79                  "\tSet one flag in the new or current security context. The following\n"
  80                  "\tflags are supported. The option may be used several time.\n"
  81                  "\n"
  82                  "\tfakeinit: The new process will believe it is process number 1.\n"
  83                  "            Useful to run a real /sbin/init in a vserver.\n"
  84                  "\tlock: The new process is trapped and can't use chcontext anymore.\n"
  85                  "\tsched: The new process and its children will share a common \n"
  86                  "         execution priority.\n"
  87                  "\tnproc: Limit the number of process in the vserver according to\n"
  88                  "         ulimit setting. Normally, ulimit is a per user thing.\n"
  89                  "         With this flag, it becomes a per vserver thing.\n"
  90                  "\tprivate: No one can join this security context once created.\n"
  91                  "\tulimit: Apply the current ulimit to the whole context\n"
  92
  93                  "--hostname new_hostname\n"
  94                  "\tSet the hostname in the new security context\n"
  95                  "\tThis is need because if you create a less privileged\n"
  96                  "\tsecurity context, it may be unable to change its hostname\n"
  97
  98                  "--secure\n"
  99                  "\tRemove all the capabilities to make a virtual server trustable\n"
 100
 101                  "--silent\n"
 102                  "\tDo not print the allocated context number.\n"
 103                  "\n"
 104                  "Information about context is found in /proc/self/status\n");
 105 }
 106
 107
 108 int main (int argc, char *argv[])
 109 {
 110         int ret = -1;
 111         int i;
 112         int nbctx = 0;
 113         int ctxs[16];
 114         int disconnect = 0;
 115         int fakeinit = 0;
 116         int silent = 0;
 117         int flags = 0;
 118         unsigned remove_cap = 0;
 119         unsigned add_cap = 0;
 120         unsigned long secure = ( ( 1<<VC_CAP_LINUX_IMMUTABLE)
 121                                  |(1<<VC_CAP_NET_BROADCAST)
 122                                  |(1<<VC_CAP_NET_ADMIN)
 123                                  |(1<<VC_CAP_NET_RAW)
 124                                  |(1<<VC_CAP_IPC_LOCK)
 125                                  |(1<<VC_CAP_IPC_OWNER)
 126                                  |(1<<VC_CAP_SYS_MODULE)
 127                                  |(1<<VC_CAP_SYS_RAWIO)
 128                                  |(1<<VC_CAP_SYS_PACCT)
 129                                  |(1<<VC_CAP_SYS_ADMIN)
 130                                  |(1<<VC_CAP_SYS_BOOT)
 131                                  |(1<<VC_CAP_SYS_NICE)
 132                                  |(1<<VC_CAP_SYS_RESOURCE)
 133                                  |(1<<VC_CAP_SYS_TIME)
 134                                  |(1<<VC_CAP_MKNOD)
 135                                  |(1<<VC_CAP_QUOTACTL));
 136         const char *hostname=NULL, *domainname=NULL;
 137
 138         for (i=1; i<argc; i++){
 139                 const char *arg = argv[i];
 140                 const char *opt = argv[i+1];
 141                 if (strcmp(arg,"--ctx")==0){
 142                         if (nbctx >= 16){
 143                                 fprintf (stderr,"Too many context, max 16, ignored.\n");
 144                         }else{
 145                                 ctxs[nbctx++] = atoi(opt);
 146                         }
 147                         i++;
 148                 }else if (strcmp(arg,"--disconnect")==0){
 149                         disconnect = 1;
 150                 }else if (strcmp(arg,"--silent")==0){
 151                         silent = 1;
 152                 }else if (strcmp(arg,"--flag")==0){
 153                         if (strcmp(opt,"lock")==0){
 154                                 flags |= 1;
 155                         }else if (strcmp(opt,"sched")==0){
 156                                 flags |= 2;
 157                         }else if (strcmp(opt,"nproc")==0){
 158                                 flags |= 4;
 159                         }else if (strcmp(opt,"private")==0){
 160                                 flags |= 8;
 161                         }else if (strcmp(opt,"fakeinit")==0){
 162                                 fakeinit = 1;
 163                                 flags |= 16;
 164                         }else if (strcmp(opt,"hideinfo")==0){
 165                                 flags |= 32;
 166                         }else if (strcmp(opt,"ulimit")==0){
 167                                 flags |= 64;
 168                         }else{
 169                                 fprintf (stderr,"Unknown flag %s\n",opt);
 170                         }
 171                         i++;
 172                 }else if (strcmp(arg,"--cap")==0){
 173                         unsigned *cap = &add_cap;
 174                         int      bit;
 175
 176                         if (opt[0] == '!'){
 177                                 cap = &remove_cap;
 178                                 opt++;
 179                         }
 180
 181                         bit = vc_text2cap(opt);
 182
 183                         if (bit!=-1) *cap |= (1<<bit);
 184                         else {
 185                                 fprintf (stderr,"Unknown capability %s\n",opt);
 186                         }
 187                         i++;
 188                 }else if (strcmp(arg,"--secure")==0){
 189                         remove_cap |= secure;
 190                 }else if (strcmp(arg,"--hostname")==0){
 191                         hostname = opt;
 192                         i++;
 193                 }else if (strcmp(arg,"--domainname")==0){
 194                         if (opt != NULL && strcmp(opt,"none")==0) opt = "";
 195                         domainname = opt;
 196                         i++;
 197                 }else{
 198                         break;
 199                 }
 200         }
 201         if (i == argc){
 202                 usage();
 203         }else if (argv[i][0] == '-'){
 204                 usage();
 205         }else{
 206                 /*
 207                         We must fork early because fakeinit set the current
 208                         process as the special init process
 209                 */
 210                 if (disconnect == 0 || fork()==0){
 211                         int newctx;
 212                         if (nbctx == 0) ctxs[nbctx++] = -1;
 213                         newctx = vc_new_s_context(ctxs[0],0,flags);
 214                         if (newctx != -1){
 215                                 if (hostname != NULL){
 216                                         if (sethostname (hostname,strlen(hostname))==-1){
 217                                                 fprintf (stderr,"Can't set the host name (%s)\n"
 218                                                         ,strerror(errno));
 219                                         }else if (!silent){
 220                                                 printf ("Host name is now %s\n",hostname);
 221                                         }
 222                                 }
 223                                 if (domainname != NULL){
 224                                         setdomainname (domainname,strlen(domainname));
 225                                         if (!silent){
 226                                                 printf ("Domain name is now %s\n",domainname);
 227                                         }
 228                                 }
 229                                 remove_cap &= (~add_cap);
 230                                 if (remove_cap != 0) vc_new_s_context (-2,remove_cap,0);
 231                                 if (!silent){
 232                                         printf ("New security context is %d\n"
 233                                                 ,ctxs[0] == -1 ? newctx : ctxs[0]);
 234                                 }
 235                                 execvp (argv[i],argv+i);
 236                                 fprintf (stderr,"Can't exec %s (%s)\n",argv[i]
 237                                         ,strerror(errno));
 238                         }else{
 239                                 perror ("Can't set the new security context\n");
 240                         }
 241                         if (disconnect != 0) _exit(0);
 242                 }
 243         }
 244         return ret;
 245 }
 246