path: root/src/jail.c

#include <stdio.h>
#include <stdlib.h>
#include <sched.h>
#include <signal.h>
#include <pty.h>
#include <sys/epoll.h>
#include <sys/prctl.h>
#include <assert.h>

#include "jail.h"
#include "socket.h"
#include "server.h"
#include "utils.h"
#include "log.h"

typedef struct jail_prisoner_process {
    pid_t prisoner_pid;
    psocket client_psock;
    char host_buf[NI_MAXHOST], service_buf[NI_MAXSERV];
    char *newroot;
} jail_prisoner_process;

static int jail_mainloop_epoll(int epoll_fd, jail_ctx *ctx[], size_t siz);
static int jail_accept_client(jail_ctx *ctx[],
                              size_t siz, struct epoll_event *event);
static int jail_childfn(void *arg);


void jail_init_ctx(jail_ctx **ctx, size_t stacksize)
{
    assert(ctx);
    if (stacksize > MAX_STACKSIZE ||
        stacksize < MIN_STACKSIZE)
    {
        stacksize = MAX_STACKSIZE;
    }
    if (!*ctx)
        *ctx = (jail_ctx *) malloc(sizeof(**ctx));
    assert(*ctx);

    memset(*ctx, 0, sizeof(**ctx));
    (*ctx)->stacksize = stacksize;
    (*ctx)->stack_ptr = calloc(1, (*ctx)->stacksize);
    (*ctx)->stack_beg =
        (unsigned char *) (*ctx)->stack_ptr
            + (*ctx)->stacksize;
    assert( (*ctx)->stack_ptr );
}

int jail_setup(jail_ctx *ctx,
               const char *listen_addr, const char *listen_port)
{
    int s;
    struct addrinfo *srv_addr = NULL;

    assert(ctx);
    assert(listen_addr || listen_port);

    D2("Try to listen on %s:%s",
       (listen_addr ? listen_addr : "*"), listen_port);
    s = socket_init_in(listen_addr, listen_port, &srv_addr);
    if (s) {
        E_GAIERR(s, "Could not initialise server socket");
        return 1;
    }
    if (socket_bind_in(&ctx->sock, &srv_addr)) {
        E_STRERR("Could not bind server socket");
        return 1;
    }
    if (socket_listen_in(&ctx->sock)) {
        E_STRERR("Could not listen on server socket");
        return 1;
    }

    return 0;
}

int jail_validate_ctx(const jail_ctx *ctx)
{
    assert(ctx);
    assert(ctx->sock.addr_len > 0);

    return 0;
}

int jail_setup_epoll(jail_ctx *ctx[], size_t siz)
{
    int s, fd = epoll_create1(0); /* flags == 0 -> obsolete size arg is dropped */
    struct epoll_event ev;

    assert(ctx);
    assert(siz > 0 && siz < POTD_MAXFD);
    if (fd < 0)
        return -1;

    for (size_t i = 0; i < siz; ++i) {
        memset(&ev, 0, sizeof(ev));
        ev.data.fd = ctx[i]->sock.fd;
        ev.events = EPOLLIN | EPOLLET;

        s = socket_addrtostr_in(&ctx[i]->sock,
                                ctx[i]->host_buf, ctx[i]->service_buf);
        if (s) {
            E_GAIERR(s, "Convert socket address to string");
            return -2;
        }
        N("Jail service listening on %s:%s: %d",
            ctx[i]->host_buf, ctx[i]->service_buf, ev.data.fd);

        s = epoll_ctl(fd, EPOLL_CTL_ADD, ctx[i]->sock.fd, &ev);
        if (s) {
            close(fd);
            return -3;
        }
    }

    return fd;
}

pid_t jail_daemonize(int epoll_fd, jail_ctx *ctx[], size_t siz)
{
    pid_t p;
	int s;
	size_t i;

    assert(ctx);
    assert(siz > 0);

	for (i = 0; i < siz; ++i) {
        assert(ctx[i]);
        s = socket_addrtostr_in(&ctx[i]->sock,
                                ctx[i]->host_buf, ctx[i]->service_buf);
        if (s) {
            E_GAIERR(s, "Could not initialise jail daemon socket");
            return 1;
        }
    }

	p = fork();
	switch (p) {
        case -1:
            W_STRERR("Jail daemonize");
	        return -1;
        case 0:
            N("%s", "Jail daemon mainloop");
            jail_mainloop_epoll(epoll_fd, ctx, siz);
            break;
    }
    D2("Jail daemon pid: %d", p);

    return p;
}

static int jail_mainloop_epoll(int epoll_fd, jail_ctx *ctx[], size_t siz)
{
    static struct epoll_event *events = NULL;
    sigset_t eset;

    if (!events)
        events = (struct epoll_event *) calloc(POTD_MAXEVENTS, sizeof(*events));

    assert(events);
    assert(ctx);
    assert(siz > 0 && siz < POTD_MAXFD);

    set_procname("[potd] jail");
    assert( set_child_sighandler() == 0 );
    sigemptyset(&eset);

    D2("Epoll fd: %d", epoll_fd);
    while (1) {
        int n, i;

        n = epoll_pwait(epoll_fd, events, POTD_MAXEVENTS, -1, &eset);
        if (n < 0)
            goto error;

        for (i = 0; i < n; ++i) {
            if ((events[i].events & EPOLLERR) ||
                (events[i].events & EPOLLHUP) ||
                (!(events[i].events & EPOLLIN)))
            {
                E("Epoll for descriptor %d failed", events[i].data.fd);
                E_STRERR("epoll_wait");
                close(events[i].data.fd);
                continue;
            } else {
                if (jail_accept_client(ctx, siz, &events[i])) {
                    /* new client connection, accept succeeded */
                    continue;
                }
                W2("Jail daemon accept client failed:  [fd: %d , npoll: %d]", events[i].data.fd, n);
            }
        }
    }

    close(epoll_fd);
    exit(EXIT_SUCCESS);
error:
    close(epoll_fd);
    exit(EXIT_FAILURE);
}

static int jail_accept_client(jail_ctx *ctx[],
                              size_t siz, struct epoll_event *event)
{
    int clone_flags = CLONE_NEWUTS|CLONE_NEWPID|CLONE_NEWIPC|
       CLONE_NEWNS|CLONE_NEWNET;
    size_t i, rc = 0;
    int s;
    jail_prisoner_process *args;

    for (i = 0; i < siz; ++i) {
        if (ctx[i]->sock.fd == event->data.fd) {
            args = (jail_prisoner_process *) calloc(1, sizeof(*args));
            assert(args);
            args->newroot = ctx[i]->newroot;

            if (socket_accept_in(&ctx[i]->sock, &args->client_psock)) {
                E_STRERR("Could not accept client connection");
                goto error;
            }

            s = socket_addrtostr_in(&args->client_psock,
                                    args->host_buf, args->service_buf);
            if (s) {
                E_GAIERR(s, "Convert socket address to string");
                goto error;
            }
            N2("New connection from %s:%s to %s:%s: %d",
                args->host_buf, args->service_buf,
                ctx[i]->host_buf, ctx[i]->service_buf,
                args->client_psock.fd);

            args->prisoner_pid = clone(jail_childfn, ctx[i]->stack_beg,
                SIGCHLD|clone_flags, args);

            rc = 1;
error:
            socket_close(&args->client_psock);
            free(args);
            return rc;
        }
    }

    return rc;
}

static int jail_childfn(void *arg)
{
    jail_prisoner_process *args;
    const char *path_dev = "/dev";
    int term_fd;
    struct termios *term = NULL;
    struct winsize *win = NULL;
    pid_t child_pid;

    assert(arg);
    args = (jail_prisoner_process *) arg;

    if (prctl(PR_SET_PDEATHSIG, SIGKILL) != 0) {
        E_STRERR("Jail child prctl");
        exit(EXIT_FAILURE);
    }

    if (!args->newroot) {
        E2("%s", "No new root set");
        exit(EXIT_FAILURE);
    }
    D2("Safe change root to: '%s'", args->newroot);
    if (safe_chroot(args->newroot)) {
        E2("Safe jail chroot to '%s' failed", args->newroot);
        exit(EXIT_FAILURE);
    }

    D2("Mounting %s to %s%s", path_dev, args->newroot, path_dev);
    if (dir_is_mountpoint(path_dev) > 0) {
        W2("%s%s is already a mountpoint", args->newroot, path_dev);
    }
    if (mount_dev(path_dev)) {
        E2("Can not mount /dev to %s%s", args->newroot, path_dev);
        exit(EXIT_FAILURE);
    }

    D2("%s", "Forking a new pseudo terminal");
    child_pid = forkpty(&term_fd, NULL, term, win);
    if (!child_pid) {
        if (execl("/bin/bash", "/bin/bash", (char *) NULL)) {
            exit(EXIT_FAILURE);
        }
    } else {
        W_STRERR("Forking a new pseudo terminal");
    }

    exit(EXIT_FAILURE);
}