initial checkin
[util-vserver.git] / util-vserver / src / chcontext.c
1 // $Id$
2
3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
4 // based on chcontext.cc by Jacques Gelinas
5 //  
6 // This program is free software; you can redistribute it and/or modify
7 // it under the terms of the GNU General Public License as published by
8 // the Free Software Foundation; either version 2, or (at your option)
9 // any later version.
10 //  
11 // This program is distributed in the hope that it will be useful,
12 // but WITHOUT ANY WARRANTY; without even the implied warranty of
13 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 // GNU General Public License for more details.
15 //  
16 // You should have received a copy of the GNU General Public License
17 // along with this program; if not, write to the Free Software
18 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19
20 /*
21         chcontext is a wrapper to user the new_s_context system call. It
22         does little more than mapping command line option to the system call
23         arguments.
24 */
25 #include <stdio.h>
26 #include <unistd.h>
27 #include <string.h>
28 #include <stdlib.h>
29 #include <errno.h>
30
31 #include "linuxcaps.h"
32 #include "vserver.h"
33
34 static void usage()
35 {
36         fprintf (stderr,"chcontext version %s\n",VERSION);
37         fprintf (stderr
38                 ,"chcontext [ options ] command arguments ...\n"
39                  "\n"
40                  "chcontext allocate a new security context and executes\n"
41                  "a command in that context.\n"
42                  "By default, a new/unused context is allocated\n"
43                  "\n"
44
45                  "--cap CAP_NAME\n"
46                  "\tAdd a capability from the command. This option may be\n"
47                  "\trepeated several time.\n"
48                  "\tSee /usr/include/linux/capability.h\n"
49                  "\tIn general, this option is used with the --secure option\n"
50                  "\t--secure removes most critical capabilities and --cap\n"
51                  "\tadds specific ones.\n"
52                  "\n"
53
54                  "--cap !CAP_NAME\n"
55                  "\tRemove a capability from the command. This option may be\n"
56                  "\trepeated several time.\n"
57                  "\tSee /usr/include/linux/capability.h\n"
58                  "\n"
59                  "--ctx num\n"
60                  "\tSelect the context. On root in context 0 is allowed to\n"
61                  "\tselect a specific context.\n"
62                  "\tContext number 1 is special. It can see all processes\n"
63                  "\tin any contexts, but can't kill them though.\n"
64                  "\tOption --ctx may be repeated several times to specify up to 16 contexts.\n"
65
66                  "--disconnect\n"
67                  "\tStart the command in background and make the process\n"
68                  "\ta child of process 1.\n"
69
70                  "--domainname new_domainname\n"
71                  "\tSet the domainname (NIS) in the new security context.\n"
72                  "\tUse \"none\" to unset the domain name.\n"
73
74                  "--flag\n"
75                  "\tSet one flag in the new or current security context. The following\n"
76                  "\tflags are supported. The option may be used several time.\n"
77                  "\n"
78                  "\tfakeinit: The new process will believe it is process number 1.\n"
79                  "            Useful to run a real /sbin/init in a vserver.\n"
80                  "\tlock: The new process is trapped and can't use chcontext anymore.\n"
81                  "\tsched: The new process and its children will share a common \n"
82                  "         execution priority.\n"
83                  "\tnproc: Limit the number of process in the vserver according to\n"
84                  "         ulimit setting. Normally, ulimit is a per user thing.\n"
85                  "         With this flag, it becomes a per vserver thing.\n"
86                  "\tprivate: No one can join this security context once created.\n"
87                  "\tulimit: Apply the current ulimit to the whole context\n"
88
89                  "--hostname new_hostname\n"
90                  "\tSet the hostname in the new security context\n"
91                  "\tThis is need because if you create a less privileged\n"
92                  "\tsecurity context, it may be unable to change its hostname\n"
93
94                  "--secure\n"
95                  "\tRemove all the capabilities to make a virtual server trustable\n"
96
97                  "--silent\n"
98                  "\tDo not print the allocated context number.\n"
99                  "\n"
100                  "Information about context is found in /proc/self/status\n");
101 }
102
103
104 int main (int argc, char *argv[])
105 {
106         int ret = -1;
107         int i;
108         int nbctx = 0;
109         int ctxs[16];
110         int disconnect = 0;
111         int fakeinit = 0;
112         int silent = 0;
113         int flags = 0;
114         unsigned remove_cap = 0;
115         unsigned add_cap = 0;
116         unsigned long secure = (1<<CAP_LINUX_IMMUTABLE)
117                 |(1<<CAP_NET_BROADCAST)
118                 |(1<<CAP_NET_ADMIN)
119                 |(1<<CAP_NET_RAW)
120                 |(1<<CAP_IPC_LOCK)
121                 |(1<<CAP_IPC_OWNER)
122                 |(1<<CAP_SYS_MODULE)
123                 |(1<<CAP_SYS_RAWIO)
124                 |(1<<CAP_SYS_PACCT)
125                 |(1<<CAP_SYS_ADMIN)
126                 |(1<<CAP_SYS_BOOT)
127                 |(1<<CAP_SYS_NICE)
128                 |(1<<CAP_SYS_RESOURCE)
129                 |(1<<CAP_SYS_TIME)
130                 |(1<<CAP_MKNOD);
131         const char *hostname=NULL, *domainname=NULL;
132
133         for (i=1; i<argc; i++){
134                 const char *arg = argv[i];
135                 const char *opt = argv[i+1];
136                 if (strcmp(arg,"--ctx")==0){
137                         if (nbctx >= 16){
138                                 fprintf (stderr,"Too many context, max 16, ignored.\n");
139                         }else{
140                                 ctxs[nbctx++] = atoi(opt);
141                         }
142                         i++;
143                 }else if (strcmp(arg,"--disconnect")==0){
144                         disconnect = 1;
145                 }else if (strcmp(arg,"--silent")==0){
146                         silent = 1;
147                 }else if (strcmp(arg,"--flag")==0){
148                         if (strcmp(opt,"lock")==0){
149                                 flags |= 1;
150                         }else if (strcmp(opt,"sched")==0){
151                                 flags |= 2;
152                         }else if (strcmp(opt,"nproc")==0){
153                                 flags |= 4;
154                         }else if (strcmp(opt,"private")==0){
155                                 flags |= 8;
156                         }else if (strcmp(opt,"fakeinit")==0){
157                                 fakeinit = 1;
158                                 flags |= 16;
159                         }else if (strcmp(opt,"hideinfo")==0){
160                                 flags |= 32;
161                         }else if (strcmp(opt,"ulimit")==0){
162                                 flags |= 64;
163                         }else{
164                                 fprintf (stderr,"Unknown flag %s\n",opt);
165                         }
166                         i++;
167                 }else if (strcmp(arg,"--cap")==0){
168                         static struct {
169                                 const char *option;
170                                 int bit;
171                         }tbcap[]={
172                                 // The following capabilities are normally available
173                                 // to vservers administrator, but are place for
174                                 // completeness
175                                 {"CAP_CHOWN",CAP_CHOWN},
176                                 {"CAP_DAC_OVERRIDE",CAP_DAC_OVERRIDE},
177                                 {"CAP_DAC_READ_SEARCH",CAP_DAC_READ_SEARCH},
178                                 {"CAP_FOWNER",CAP_FOWNER},
179                                 {"CAP_FSETID",CAP_FSETID},
180                                 {"CAP_KILL",CAP_KILL},
181                                 {"CAP_SETGID",CAP_SETGID},
182                                 {"CAP_SETUID",CAP_SETUID},
183                                 {"CAP_SETPCAP",CAP_SETPCAP},
184                                 {"CAP_SYS_TTY_CONFIG",CAP_SYS_TTY_CONFIG},
185                                 {"CAP_LEASE",CAP_LEASE},
186                                 {"CAP_SYS_CHROOT",CAP_SYS_CHROOT},
187
188                                 // Those capabilities are not normally available
189                                 // to vservers because they are not needed and
190                                 // may represent a security risk
191                                 {"CAP_LINUX_IMMUTABLE",CAP_LINUX_IMMUTABLE},
192                                 {"CAP_NET_BIND_SERVICE",CAP_NET_BIND_SERVICE},
193                                 {"CAP_NET_BROADCAST",CAP_NET_BROADCAST},
194                                 {"CAP_NET_ADMIN",       CAP_NET_ADMIN},
195                                 {"CAP_NET_RAW", CAP_NET_RAW},
196                                 {"CAP_IPC_LOCK",        CAP_IPC_LOCK},
197                                 {"CAP_IPC_OWNER",       CAP_IPC_OWNER},
198                                 {"CAP_SYS_MODULE",CAP_SYS_MODULE},
199                                 {"CAP_SYS_RAWIO",       CAP_SYS_RAWIO},
200                                 {"CAP_SYS_PACCT",       CAP_SYS_PACCT},
201                                 {"CAP_SYS_ADMIN",       CAP_SYS_ADMIN},
202                                 {"CAP_SYS_BOOT",        CAP_SYS_BOOT},
203                                 {"CAP_SYS_NICE",        CAP_SYS_NICE},
204                                 {"CAP_SYS_RESOURCE",CAP_SYS_RESOURCE},
205                                 {"CAP_SYS_TIME",        CAP_SYS_TIME},
206                                 {"CAP_MKNOD",           CAP_MKNOD},
207                                 {NULL,0}
208                         };
209                         int j;
210                         unsigned *cap = &add_cap;
211                         if (opt[0] == '!'){
212                                 cap = &remove_cap;
213                                 opt++;
214                         }
215                         for (j=0; tbcap[j].option != NULL; j++){
216                                 if (strcasecmp(tbcap[j].option,opt)==0){
217                                         *cap |= (1<<tbcap[j].bit);
218                                         break;
219                                 }
220                         }
221                         if (tbcap[j].option == NULL){
222                                 fprintf (stderr,"Unknown capability %s\n",opt);
223                         }
224                         i++;
225                 }else if (strcmp(arg,"--secure")==0){
226                         remove_cap |= secure;
227                 }else if (strcmp(arg,"--hostname")==0){
228                         hostname = opt;
229                         i++;
230                 }else if (strcmp(arg,"--domainname")==0){
231                         if (opt != NULL && strcmp(opt,"none")==0) opt = "";
232                         domainname = opt;
233                         i++;
234                 }else{
235                         break;
236                 }
237         }
238         if (i == argc){
239                 usage();
240         }else if (argv[i][0] == '-'){
241                 usage();
242         }else{
243                 /*
244                         We must fork early because fakeinit set the current
245                         process as the special init process
246                 */
247                 if (disconnect == 0 || fork()==0){
248                         int newctx;
249                         if (nbctx == 0) ctxs[nbctx++] = -1;
250                         newctx = call_new_s_context(nbctx,ctxs,0,flags);
251                         if (newctx != -1){
252                                 if (hostname != NULL){
253                                         if (sethostname (hostname,strlen(hostname))==-1){
254                                                 fprintf (stderr,"Can't set the host name (%s)\n"
255                                                         ,strerror(errno));
256                                         }else if (!silent){
257                                                 printf ("Host name is now %s\n",hostname);
258                                         }
259                                 }
260                                 if (domainname != NULL){
261                                         setdomainname (domainname,strlen(domainname));
262                                         if (!silent){
263                                                 printf ("Domain name is now %s\n",domainname);
264                                         }
265                                 }
266                                 remove_cap &= (~add_cap);
267                                 if (remove_cap != 0) call_new_s_context (0,NULL,remove_cap,0);
268                                 if (!silent){
269                                         printf ("New security context is %d\n"
270                                                 ,ctxs[0] == -1 ? newctx : ctxs[0]);
271                                 }
272                                 execvp (argv[i],argv+i);
273                                 fprintf (stderr,"Can't exec %s (%s)\n",argv[i]
274                                         ,strerror(errno));
275                         }else{
276                                 perror ("Can't set the new security context\n");
277                         }
278                         if (disconnect != 0) _exit(0);
279                 }
280         }
281         return ret;
282 }
283