POTD skeleton #34.

Signed-off-by: lns <matzeton@googlemail.com>

5 files changed, 42 insertions, 0 deletions

diff --git a/src/jail.c b/src/jail.c
index abf88e5..d5e2716 100644
--- a/src/jail.c
+++ b/src/jail.c
@@ -16,6 +16,7 @@ typedef struct jail_prisoner_process {
     pid_t prisoner_pid;
     psocket client_psock;
     char host_buf[NI_MAXHOST], service_buf[NI_MAXSERV];
+    char *newroot;
 } jail_prisoner_process;
 
 static int jail_mainloop_epoll(int epoll_fd, jail_ctx *ctx[], size_t siz);
@@ -212,6 +213,7 @@ static int jail_accept_client(jail_ctx *ctx[],
         if (ctx[i]->sock.fd == event->data.fd) {
             args = (jail_prisoner_process *) calloc(1, sizeof(*args));
             assert(args);
+            args->newroot = ctx[i]->newroot;
 
             if (socket_accept_in(&ctx[i]->sock, &args->client_psock)) {
                 E_STRERR("Could not accept client connection");
@@ -254,6 +256,17 @@ static int jail_childfn(void *arg)
         E_STRERR("Jail child prctl");
         exit(EXIT_FAILURE);
     }
+
+    if (!args->newroot) {
+        E2("%s", "No new root set");
+        exit(EXIT_FAILURE);
+    }
+    N2("Safe change root to: '%s'", args->newroot);
+    if (safe_chroot(args->newroot)) {
+        E2("Safe jail chroot to '%s' failed", args->newroot);
+        exit(EXIT_FAILURE);
+    }
+
     printf("----> CHILD FN: %d <----\n", args->client_psock.fd);
     sleep(10);
 
diff --git a/src/jail.h b/src/jail.h
index a7dff6b..37a10a5 100644
--- a/src/jail.h
+++ b/src/jail.h
@@ -15,6 +15,7 @@ typedef struct jail_ctx {
     size_t stacksize;
     void *stack_ptr;
     void *stack_beg;
+    char *newroot;
 } jail_ctx;
 
 
diff --git a/src/main.c b/src/main.c
index 5c095ac..4e78150 100644
--- a/src/main.c
+++ b/src/main.c
@@ -52,6 +52,7 @@ int main(int argc, char *argv[])
 
     for (size_t i = 0; i < jail_siz; ++i) {
         jail_init_ctx(&jail[i], MAX_STACKSIZE);
+        jail[i]->newroot = strdup("/home/lns/git/busybox/sysroot");
         ABORT_ON_FATAL( jail_setup(jail[i], "127.0.0.1", jail_ports[i]),
             "Jail daemon setup" );
         ABORT_ON_FATAL( jail_validate_ctx(jail[i]),
diff --git a/src/utils.c b/src/utils.c
index 3b44331..7671ac5 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -201,3 +201,28 @@ int change_user_group(const char *user, const char *group)
 
     return 0;
 }
+
+int safe_chroot(const char *newroot)
+{
+    int s;
+
+    s = chdir(newroot);
+    if (s) {
+        E_STRERR("Change directory");
+        return 1;
+    }
+
+    s = chroot(".");
+    if (s) {
+        E_STRERR("Change root directory");
+        return 1;
+    }
+
+    s = chdir("/");
+    if (s) {
+        E_STRERR("Change directory inside new root");
+        return 1;
+    }
+
+    return 0;
+}
diff --git a/src/utils.h b/src/utils.h
index 22a2b07..2cabfd0 100644
--- a/src/utils.h
+++ b/src/utils.h
@@ -20,4 +20,6 @@ int redirect_devnull_to(int fds, ...);
 
 int change_user_group(const char *user, const char *group);
 
+int safe_chroot(const char *newroot);
+
 #endif