src/main/tools/namespace-sandbox.c - bazel - Git at Google

 #define _GNU_SOURCE

 // Copyright 2014 Google Inc. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //    http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.

 #include <errno.h>
 #include <fcntl.h>
 #include <getopt.h>
 #include <limits.h>
 #include <linux/capability.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mount.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>

 static int global_debug = 0;
 static int global_cpid; // Returned by fork()

 #define PRINT_DEBUG(...) do { if (global_debug) {fprintf(stderr, "sandbox.c: " __VA_ARGS__);}} while(0)

 #define CHECK_CALL(x) if ((x) == -1) { perror(#x); exit(1); }
 #define CHECK_NOT_NULL(x) if (x == NULL) { perror(#x); exit(1); }
 #define DIE() do { fprintf(stderr, "Error in %d\n", __LINE__); exit(-1); } while(0);

 int kChildrenCleanupDelay = 1;

 void Usage() {
   fprintf(stderr,
           "Usage: ./sandbox [-R sandbox-root] [-m mount] -C command arg1\n"
           "Mandatory arguments:\n"
           "  -C command to run inside sandbox, followed by arguments\n"
           "  -S directory which will become the root of the sandbox\n"
           "\n"
           "Optional arguments:\n"
           "  -t absolute path to bazel tools directory\n"
           "  -T timeout after which sandbox will be terminated\n"
           "  -m system directory to mount inside the sandbox\n"
           " Multiple directories can be specified and each of them will\n"
           " be mount as readonly\n"
           "  -D if set, debug info will be printed\n");
   exit(1);
 }

 void PropagateSignals();
 void EnableAlarm();
 void SetupSlashDev();

 static volatile sig_atomic_t global_signal_received = 0;

 int main(int argc, char *argv[]) {
   char *include_prefix = NULL;
   char *sandbox_root = NULL;
   char *tools = NULL;
   char **mounts = malloc(argc * sizeof(char*));
   char **includes = malloc(argc * sizeof(char*));
   int num_mounts = 0;
   int num_includes = 0;
   int iArg = 0;
   int uid = getuid();
   int gid = getgid();
   int timeout = 0;

   for (iArg = 1; iArg < argc - 1; iArg++) {
     if (strlen(argv[iArg]) != 2) {
       Usage();
     }
     if (argv[iArg][0] != '-') {
       Usage();
     }
     switch (argv[iArg][1]) {
       case 'S':
         if (sandbox_root == NULL) {
           sandbox_root = argv[++iArg];
         } else {
           fprintf(stderr,
                   "Multiple sandbox roots (-S) specified (expected one).\n");
           Usage();
         }
         break;
       case 'm':
         mounts[num_mounts++] = argv[++iArg];
         break;
       case 'D':
         global_debug = 1;
         break;
       case 'T':
         sscanf(argv[iArg], "%d", &timeout);
         break;
       case 'N':
         include_prefix = argv[++iArg];
         break;
       case 'n':
         includes[num_includes++] = argv[++iArg];
         break;
       case 'C':
         iArg++;
         goto parsing_finished;
       case 't':
         tools = argv[++iArg];
         break;
       default:
         fprintf(stderr, "Unrecognized argument: %s\n", argv[iArg]);
         Usage();
     }
   }

 parsing_finished:
   if (iArg == argc) {
     fprintf(stderr, "No command specified.\n");
     Usage();
   }
   if (timeout < 0) {
     fprintf(stderr, "Invalid timeout (-T) value: %d", timeout);
     Usage();
   }

   // parsed all arguments, now prepare sandbox

   PRINT_DEBUG("%s\n", sandbox_root);
   // create new namespaces in which this process and its children will live
   CHECK_CALL(unshare(CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER));
   CHECK_CALL(mount("none", "/", NULL, MS_REC | MS_PRIVATE, NULL));
   // mount sandbox and go there
   CHECK_CALL(mount(sandbox_root, sandbox_root, NULL, MS_BIND | MS_NOSUID, NULL));
   CHECK_CALL(chdir(sandbox_root));

   SetupSlashDev();
   // mount blaze specific directories - tools/ and build-runfiles/
   if (tools != NULL) {
     PRINT_DEBUG("tools: %s\n", tools);
     CHECK_CALL(mkdir("tools", 0755));
     CHECK_CALL(mount(tools, "tools", NULL, MS_BIND | MS_RDONLY, NULL));
   }

   // mounts passed in argv; those are mostly dirs for shared libs
   for (int i = 0; i < num_mounts; i++) {
     CHECK_CALL(mount(mounts[i], mounts[i] + 1, NULL, MS_BIND | MS_RDONLY, NULL));
   }

   // c++ compilation
   // headers go in separate directory
   if (include_prefix != NULL) {
     CHECK_CALL(chdir(include_prefix));
     for (int i = 0; i < num_includes; i++) {
       // TODO(bazel-team) sometimes list of -iquote given by bazel contains
       // invalid (non-existing) entries, ideally we would like not to have them
       PRINT_DEBUG("include: %s\n", includes[i]);
       if (mount(includes[i], includes[i] + 1 , NULL, MS_BIND, NULL) > -1) {
         continue;
       }
       if (errno == ENOENT) {
         continue;
       }
       CHECK_CALL(-1);
     }
     CHECK_CALL(chdir(".."));
   }

   // set group and user mapping from outer namespace to inner:
   // no changes in the parent, be root in the child
   int uid_fd, gid_fd;
   char uid_mapping[64], gid_mapping[64];
   sprintf(uid_mapping, "0 %d 1\n", uid);
   sprintf(gid_mapping, "0 %d 1\n", gid);
   uid_fd = open("/proc/self/uid_map", O_WRONLY);
   CHECK_CALL(uid_fd);
   CHECK_CALL(write(uid_fd, uid_mapping, strlen(uid_mapping)));
   CHECK_CALL(close(uid_fd));

   gid_fd = open("/proc/self/gid_map", O_WRONLY);
   CHECK_CALL(gid_fd);
   CHECK_CALL(write(gid_fd, gid_mapping, strlen(gid_mapping)));
   CHECK_CALL(close(gid_fd));

   CHECK_CALL(setresuid(0, 0, 0));
   CHECK_CALL(setresgid(0, 0, 0));

   CHECK_CALL(mkdir("proc", 0755));
   CHECK_CALL(mount("/proc", "proc", NULL, MS_REC | MS_BIND, NULL));
   // make sandbox actually hermetic:
   // move the real root to old_root, then detach it
   char old_root[16] = "old-root-XXXXXX";
   CHECK_NOT_NULL(mkdtemp(old_root));
   // pivot_root has no wrapper in libc, so we need syscall()
   CHECK_CALL(syscall(SYS_pivot_root, ".", old_root));
   CHECK_CALL(chroot("."));
   CHECK_CALL(umount2(old_root, MNT_DETACH));
   CHECK_CALL(rmdir(old_root));

   free(mounts);
   free(includes);

   for (int i = iArg; i < argc; i += 1) {
     PRINT_DEBUG("arg: %s\n", argv[i]);
   }

   // spawn child and wait until it finishes
   global_cpid = fork();
   if (global_cpid == 0) {
     CHECK_CALL(setpgid(0, 0));
     // if the execvp below fails with "No such file or directory" it means that:
     // a) the binary is not in the sandbox (which means it wasn't included in
     // the inputs)
     // b) the binary uses shared library which is not inside sandbox - you can
     // check for that by running "ldd ./a.out" (by default directories
     // starting with /lib* and /usr/lib* should be there)
     // c) the binary uses elf interpreter which is not inside sandbox - you can
     // check for that by running "readelf -a a.out | grep interpreter" (the
     // sandbox code assumes that it is either in /lib*/ or /usr/lib*/)
     CHECK_CALL(execvp(argv[iArg], argv + iArg));
     PRINT_DEBUG("Exec failed near %s:%d\n", __FILE__, __LINE__);
     exit(1);
   } else {
     // PARENT
     // make sure that all signals propagate to children (mostly useful to kill
     // entire sandbox)
     PropagateSignals();
     // after given timeout, kill children
     EnableAlarm(timeout);
     int status = 0;
     while (1) {
       PRINT_DEBUG("Waiting for the child...\n");
       pid_t pid = wait(&status);
       if (global_signal_received) {
         PRINT_DEBUG("Received signal: %s\n", strsignal(global_signal_received));
         CHECK_CALL(killpg(global_cpid, global_signal_received));
         // give children some time for cleanup before they terminate
         sleep(kChildrenCleanupDelay);
         CHECK_CALL(killpg(global_cpid, SIGKILL));
         exit(128 | global_signal_received);
       }
       if (errno == EINTR) {
         continue;
       }
       if (pid < 0) {
         perror("Wait failed:");
         exit(1);
       }
       if (WIFEXITED(status)) {
         PRINT_DEBUG("Child exited with status: %d\n", WEXITSTATUS(status));
         exit(WEXITSTATUS(status));
       }
       if (WIFSIGNALED(status)) {
         PRINT_DEBUG("Child terminated by a signal: %d\n", WTERMSIG(status));
         exit(WEXITSTATUS(status));
       }
       if (WIFSTOPPED(status)) {
         PRINT_DEBUG("Child stopped by a signal: %d\n", WSTOPSIG(status));
       }
     }
   }

   return 0;
 }

 void SignalHandler(int signum, siginfo_t *info, void *uctxt) {
   global_signal_received = signum;
 }

 void PropagateSignals() {
   // propagate some signals received by the parent to processes in sandbox, so
   // that it's easier to terminate entire sandbox
   struct sigaction action = {};
   action.sa_flags = SA_SIGINFO;
   action.sa_sigaction = SignalHandler;

   // handle all signals that could terminate the process
   int signals[] = {SIGHUP, SIGINT, SIGKILL, SIGPIPE, SIGALRM, SIGTERM, SIGPOLL,
     SIGPROF, SIGVTALRM,
     // signals below produce core dump by default, however at the moment we'll
     // just terminate
     SIGQUIT, SIGILL, SIGABRT, SIGFPE, SIGSEGV, SIGBUS, SIGSYS, SIGTRAP, SIGXCPU,
     SIGXFSZ, -1};
   for (int *p = signals; *p != -1; p++) {
     sigaction(*p, &action, NULL);
   }
 }

 void SetupSlashDev() {
   CHECK_CALL(mkdir("dev", 0755));
   const char *devs[] = {
     "/dev/null",
     "/dev/random",
     "/dev/urandom",
     "/dev/zero",
     NULL
   };
   for (int i = 0; devs[i] != NULL; i++) {
     // open+close to create the file, which will become mount point for actual
     // device
     int handle = open(devs[i] + 1, O_CREAT | O_RDONLY, 0644);
     CHECK_CALL(handle);
     CHECK_CALL(close(handle));
     CHECK_CALL(mount(devs[i], devs[i] + 1, NULL, MS_BIND, NULL));
   }
 }

 void EnableAlarm(int timeout) {
   if (timeout <= 0) return;

   struct itimerval timer = {};
   timer.it_value.tv_sec = (long) timeout;
   CHECK_CALL(setitimer(ITIMER_REAL, &timer, NULL));
 }
	#define _GNU_SOURCE

	// Copyright 2014 Google Inc. All rights reserved.
	//
	// Licensed under the Apache License, Version 2.0 (the "License");
	// you may not use this file except in compliance with the License.
	// You may obtain a copy of the License at
	//
	// http://www.apache.org/licenses/LICENSE-2.0
	//
	// Unless required by applicable law or agreed to in writing, software
	// distributed under the License is distributed on an "AS IS" BASIS,
	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	// See the License for the specific language governing permissions and
	// limitations under the License.

	#include <errno.h>
	#include <fcntl.h>
	#include <getopt.h>
	#include <limits.h>
	#include <linux/capability.h>
	#include <sched.h>
	#include <signal.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/mount.h>
	#include <sys/stat.h>
	#include <sys/syscall.h>
	#include <sys/time.h>
	#include <sys/types.h>
	#include <sys/wait.h>
	#include <unistd.h>

	static int global_debug = 0;
	static int global_cpid; // Returned by fork()

	#define PRINT_DEBUG(...) do { if (global_debug) {fprintf(stderr, "sandbox.c: " __VA_ARGS__);}} while(0)

	#define CHECK_CALL(x) if ((x) == -1) { perror(#x); exit(1); }
	#define CHECK_NOT_NULL(x) if (x == NULL) { perror(#x); exit(1); }
	#define DIE() do { fprintf(stderr, "Error in %d\n", __LINE__); exit(-1); } while(0);

	int kChildrenCleanupDelay = 1;

	void Usage() {
	fprintf(stderr,
	"Usage: ./sandbox [-R sandbox-root] [-m mount] -C command arg1\n"
	"Mandatory arguments:\n"
	" -C command to run inside sandbox, followed by arguments\n"
	" -S directory which will become the root of the sandbox\n"
	"\n"
	"Optional arguments:\n"
	" -t absolute path to bazel tools directory\n"
	" -T timeout after which sandbox will be terminated\n"
	" -m system directory to mount inside the sandbox\n"
	" Multiple directories can be specified and each of them will\n"
	" be mount as readonly\n"
	" -D if set, debug info will be printed\n");
	exit(1);
	}

	void PropagateSignals();
	void EnableAlarm();
	void SetupSlashDev();

	static volatile sig_atomic_t global_signal_received = 0;

	int main(int argc, char *argv[]) {
	char *include_prefix = NULL;
	char *sandbox_root = NULL;
	char *tools = NULL;
	char *mounts = malloc(argc sizeof(char*));
	char *includes = malloc(argc sizeof(char*));
	int num_mounts = 0;
	int num_includes = 0;
	int iArg = 0;
	int uid = getuid();
	int gid = getgid();
	int timeout = 0;

	for (iArg = 1; iArg < argc - 1; iArg++) {
	if (strlen(argv[iArg]) != 2) {
	Usage();
	}
	if (argv[iArg][0] != '-') {
	Usage();
	}
	switch (argv[iArg][1]) {
	case 'S':
	if (sandbox_root == NULL) {
	sandbox_root = argv[++iArg];
	} else {
	fprintf(stderr,
	"Multiple sandbox roots (-S) specified (expected one).\n");
	Usage();
	}
	break;
	case 'm':
	mounts[num_mounts++] = argv[++iArg];
	break;
	case 'D':
	global_debug = 1;
	break;
	case 'T':
	sscanf(argv[iArg], "%d", &timeout);
	break;
	case 'N':
	include_prefix = argv[++iArg];
	break;
	case 'n':
	includes[num_includes++] = argv[++iArg];
	break;
	case 'C':
	iArg++;
	goto parsing_finished;
	case 't':
	tools = argv[++iArg];
	break;
	default:
	fprintf(stderr, "Unrecognized argument: %s\n", argv[iArg]);
	Usage();
	}
	}

	parsing_finished:
	if (iArg == argc) {
	fprintf(stderr, "No command specified.\n");
	Usage();
	}
	if (timeout < 0) {
	fprintf(stderr, "Invalid timeout (-T) value: %d", timeout);
	Usage();
	}

	// parsed all arguments, now prepare sandbox

	PRINT_DEBUG("%s\n", sandbox_root);
	// create new namespaces in which this process and its children will live
	CHECK_CALL(unshare(CLONE_NEWNS \| CLONE_NEWUTS \| CLONE_NEWIPC \| CLONE_NEWUSER));
	CHECK_CALL(mount("none", "/", NULL, MS_REC \| MS_PRIVATE, NULL));
	// mount sandbox and go there
	CHECK_CALL(mount(sandbox_root, sandbox_root, NULL, MS_BIND \| MS_NOSUID, NULL));
	CHECK_CALL(chdir(sandbox_root));

	SetupSlashDev();
	// mount blaze specific directories - tools/ and build-runfiles/
	if (tools != NULL) {
	PRINT_DEBUG("tools: %s\n", tools);
	CHECK_CALL(mkdir("tools", 0755));
	CHECK_CALL(mount(tools, "tools", NULL, MS_BIND \| MS_RDONLY, NULL));
	}

	// mounts passed in argv; those are mostly dirs for shared libs
	for (int i = 0; i < num_mounts; i++) {
	CHECK_CALL(mount(mounts[i], mounts[i] + 1, NULL, MS_BIND \| MS_RDONLY, NULL));
	}

	// c++ compilation
	// headers go in separate directory
	if (include_prefix != NULL) {
	CHECK_CALL(chdir(include_prefix));
	for (int i = 0; i < num_includes; i++) {
	// TODO(bazel-team) sometimes list of -iquote given by bazel contains
	// invalid (non-existing) entries, ideally we would like not to have them
	PRINT_DEBUG("include: %s\n", includes[i]);
	if (mount(includes[i], includes[i] + 1 , NULL, MS_BIND, NULL) > -1) {
	continue;
	}
	if (errno == ENOENT) {
	continue;
	}
	CHECK_CALL(-1);
	}
	CHECK_CALL(chdir(".."));
	}

	// set group and user mapping from outer namespace to inner:
	// no changes in the parent, be root in the child
	int uid_fd, gid_fd;
	char uid_mapping[64], gid_mapping[64];
	sprintf(uid_mapping, "0 %d 1\n", uid);
	sprintf(gid_mapping, "0 %d 1\n", gid);
	uid_fd = open("/proc/self/uid_map", O_WRONLY);
	CHECK_CALL(uid_fd);
	CHECK_CALL(write(uid_fd, uid_mapping, strlen(uid_mapping)));
	CHECK_CALL(close(uid_fd));

	gid_fd = open("/proc/self/gid_map", O_WRONLY);
	CHECK_CALL(gid_fd);
	CHECK_CALL(write(gid_fd, gid_mapping, strlen(gid_mapping)));
	CHECK_CALL(close(gid_fd));

	CHECK_CALL(setresuid(0, 0, 0));
	CHECK_CALL(setresgid(0, 0, 0));

	CHECK_CALL(mkdir("proc", 0755));
	CHECK_CALL(mount("/proc", "proc", NULL, MS_REC \| MS_BIND, NULL));
	// make sandbox actually hermetic:
	// move the real root to old_root, then detach it
	char old_root[16] = "old-root-XXXXXX";
	CHECK_NOT_NULL(mkdtemp(old_root));
	// pivot_root has no wrapper in libc, so we need syscall()
	CHECK_CALL(syscall(SYS_pivot_root, ".", old_root));
	CHECK_CALL(chroot("."));
	CHECK_CALL(umount2(old_root, MNT_DETACH));
	CHECK_CALL(rmdir(old_root));

	free(mounts);
	free(includes);

	for (int i = iArg; i < argc; i += 1) {
	PRINT_DEBUG("arg: %s\n", argv[i]);
	}

	// spawn child and wait until it finishes
	global_cpid = fork();
	if (global_cpid == 0) {
	CHECK_CALL(setpgid(0, 0));
	// if the execvp below fails with "No such file or directory" it means that:
	// a) the binary is not in the sandbox (which means it wasn't included in
	// the inputs)
	// b) the binary uses shared library which is not inside sandbox - you can
	// check for that by running "ldd ./a.out" (by default directories
	// starting with /lib* and /usr/lib* should be there)
	// c) the binary uses elf interpreter which is not inside sandbox - you can
	// check for that by running "readelf -a a.out \| grep interpreter" (the
	// sandbox code assumes that it is either in /lib/ or /usr/lib/)
	CHECK_CALL(execvp(argv[iArg], argv + iArg));
	PRINT_DEBUG("Exec failed near %s:%d\n", __FILE__, __LINE__);
	exit(1);
	} else {
	// PARENT
	// make sure that all signals propagate to children (mostly useful to kill
	// entire sandbox)
	PropagateSignals();
	// after given timeout, kill children
	EnableAlarm(timeout);
	int status = 0;
	while (1) {
	PRINT_DEBUG("Waiting for the child...\n");
	pid_t pid = wait(&status);
	if (global_signal_received) {
	PRINT_DEBUG("Received signal: %s\n", strsignal(global_signal_received));
	CHECK_CALL(killpg(global_cpid, global_signal_received));
	// give children some time for cleanup before they terminate
	sleep(kChildrenCleanupDelay);
	CHECK_CALL(killpg(global_cpid, SIGKILL));
	exit(128 \| global_signal_received);
	}
	if (errno == EINTR) {
	continue;
	}
	if (pid < 0) {
	perror("Wait failed:");
	exit(1);
	}
	if (WIFEXITED(status)) {
	PRINT_DEBUG("Child exited with status: %d\n", WEXITSTATUS(status));
	exit(WEXITSTATUS(status));
	}
	if (WIFSIGNALED(status)) {
	PRINT_DEBUG("Child terminated by a signal: %d\n", WTERMSIG(status));
	exit(WEXITSTATUS(status));
	}
	if (WIFSTOPPED(status)) {
	PRINT_DEBUG("Child stopped by a signal: %d\n", WSTOPSIG(status));
	}
	}
	}

	return 0;
	}

	void SignalHandler(int signum, siginfo_t info, void uctxt) {
	global_signal_received = signum;
	}

	void PropagateSignals() {
	// propagate some signals received by the parent to processes in sandbox, so
	// that it's easier to terminate entire sandbox
	struct sigaction action = {};
	action.sa_flags = SA_SIGINFO;
	action.sa_sigaction = SignalHandler;

	// handle all signals that could terminate the process
	int signals[] = {SIGHUP, SIGINT, SIGKILL, SIGPIPE, SIGALRM, SIGTERM, SIGPOLL,
	SIGPROF, SIGVTALRM,
	// signals below produce core dump by default, however at the moment we'll
	// just terminate
	SIGQUIT, SIGILL, SIGABRT, SIGFPE, SIGSEGV, SIGBUS, SIGSYS, SIGTRAP, SIGXCPU,
	SIGXFSZ, -1};
	for (int p = signals; p != -1; p++) {
	sigaction(*p, &action, NULL);
	}
	}

	void SetupSlashDev() {
	CHECK_CALL(mkdir("dev", 0755));
	const char *devs[] = {
	"/dev/null",
	"/dev/random",
	"/dev/urandom",
	"/dev/zero",
	NULL
	};
	for (int i = 0; devs[i] != NULL; i++) {
	// open+close to create the file, which will become mount point for actual
	// device
	int handle = open(devs[i] + 1, O_CREAT \| O_RDONLY, 0644);
	CHECK_CALL(handle);
	CHECK_CALL(close(handle));
	CHECK_CALL(mount(devs[i], devs[i] + 1, NULL, MS_BIND, NULL));
	}
	}

	void EnableAlarm(int timeout) {
	if (timeout <= 0) return;

	struct itimerval timer = {};
	timer.it_value.tv_sec = (long) timeout;
	CHECK_CALL(setitimer(ITIMER_REAL, &timer, NULL));
	}