1
/* IVLE - Informatics Virtual Learning Environment
2
* Copyright (C) 2007-2008 The University of Melbourne
4
* This program is free software; you can redistribute it and/or modify
5
* it under the terms of the GNU General Public License as published by
6
* the Free Software Foundation; either version 2 of the License, or
7
* (at your option) any later version.
9
* This program is distributed in the hope that it will be useful,
10
* but WITHOUT ANY WARRANTY; without even the implied warranty of
11
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
* GNU General Public License for more details.
14
* You should have received a copy of the GNU General Public License
15
* along with this program; if not, write to the Free Software
16
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19
* Author: Tom Conway, Matt Giuca
22
* This program runs a given program in a given working dir.
23
* First, it chroots to a jail path and setuids to a given user ID.
24
* This is intented to provide a safe execution environment for arbitrary
25
* programs and scripts.
27
* Scripts (such as Python programs) should be executed by supplying
28
* "/usr/bin/python" as the program, and the script as the first argument.
30
* Usage: trampoline uid jail-path working-path program [args...]
31
* Must run as root. Will safely setuid to the supplied uid, checking that it
32
* is not root. Recommended that the file is set up as follows:
33
* sudo chown root:root trampoline; sudo chroot +s trampoline
41
#include <sys/mount.h>
42
#include <sys/types.h>
45
#include <sys/resource.h>
48
/* conf.h is admin-configured by the setup process.
49
* It defines jail_base.
55
/* Returns TRUE if the given uid is allowed to execute trampoline.
56
* Only root or the web server should be allowed to execute.
57
* This is determined by the whitelist allowed_uids in conf.h.
59
int uid_allowed(int uid)
62
/* root is always allowed to execute trampoline */
65
/* loop over all allowed_uids */
66
for (i=(sizeof(allowed_uids)/sizeof(*allowed_uids))-1; i>=0; i--)
68
if (allowed_uids[i] == uid)
71
/* default to disallowing */
75
/* Turn the process into a daemon using the standard
82
/* already a daemon */
83
if ( getppid() == 1 ) return;
85
/* Fork off the parent process */
90
/* If we got a good PID, then we can exit the parent process. */
95
/* At this point we are executing as the child process */
97
/* Change the file mode mask */
100
/* Create a new SID for the child process */
106
/* Change the current working directory. This prevents the current
107
directory from being locked; hence not being able to remove it. */
108
if ((chdir("/")) < 0) {
112
/* Redirect standard files to /dev/null */
113
freopen( "/dev/null", "r", stdin);
114
freopen( "/dev/null", "w", stdout);
115
freopen( "/dev/null", "w", stderr);
118
static void usage(const char* nm)
121
"usage: %s [-d] [-u] <uid> <jail> <cwd> <program> [args...]\n", nm);
125
#ifdef IVLE_AUFS_JAILS
126
/* Die more pleasantly if mallocs fail. */
127
void *die_if_null(void *ptr)
131
perror("not enough memory");
137
/* Find the path of the user components of a jail, given a mountpoint. */
138
char *jail_src(const char* jailpath)
144
srclen = strlen(jail_src_base);
145
dstlen = strlen(jail_base);
147
src = die_if_null(malloc(strlen(jailpath) + (srclen - dstlen) + 1));
148
strcpy(src, jail_src_base);
149
strcat(src, jailpath+dstlen);
154
/* Check for the validity of a jail in the given path, mounting it if it looks
156
* TODO: Updating /etc/mtab would be nice. */
157
void mount_if_needed(const char* jailpath)
163
/* Check if there is something useful in the jail. If not, it's probably
165
jaillib = die_if_null(malloc(strlen(jailpath) + 5));
166
sprintf(jaillib, "%s/lib", jailpath);
168
if (access(jaillib, F_OK))
170
/* No /lib? Mustn't be mounted. Mount it, creating the dir if needed. */
171
if (access(jailpath, F_OK))
173
if(mkdir(jailpath, 0755))
175
syslog(LOG_ERR, "could not create mountpoint %s\n", jailpath);
176
perror("could not create jail mountpoint");
179
syslog(LOG_NOTICE, "created mountpoint %s\n", jailpath);
182
jailsrc = jail_src(jailpath);
183
mountdata = die_if_null(malloc(3 + strlen(jailsrc) + 4 + strlen(jail_system) + 3 + 1));
184
sprintf(mountdata, "br:%s=rw:%s=ro", jailsrc, jail_system);
185
if (mount("none", jailpath, "aufs", 0, mountdata))
187
syslog(LOG_ERR, "could not mount %s\n", jailpath);
188
perror("could not mount");
192
syslog(LOG_INFO, "mounted %s\n", jailpath);
200
#endif /* IVLE_AUFS_JAILS */
202
int main(int argc, char* const argv[])
212
char canonical_jailpath[PATH_MAX];
214
/* Disallow execution from all users but the whitelisted ones, and root */
215
if (!uid_allowed(getuid()))
217
fprintf(stderr, "only the web server may execute trampoline\n");
221
/* Args check and usage */
227
if (strcmp(argv[arg_num], "-d") == 0)
237
if (strcmp(argv[arg_num], "-u") == 0)
246
uid = atoi(argv[arg_num++]);
247
jailpath = argv[arg_num++];
248
work_dir = argv[arg_num++];
249
prog = argv[arg_num];
250
args = argv + arg_num;
252
/* Disallow suiding to the root user */
255
fprintf(stderr, "cannot set up a jail as root\n");
259
/* Jail path must be an absolute path,
260
* and it must begin with jail_base.
262
if (norm(canonical_jailpath, PATH_MAX, jailpath) != 0)
264
fprintf(stderr, "bad jail path: %s\n", jailpath);
267
if (strncmp(canonical_jailpath, jail_base, strlen(jail_base)))
269
fprintf(stderr, "bad jail path: %s\n", jailpath);
273
openlog("trampoline", LOG_CONS | LOG_PID | LOG_NDELAY, LOG_USER);
275
#ifdef IVLE_AUFS_JAILS
276
mount_if_needed(canonical_jailpath);
277
#endif /* IVLE_AUFS_JAILS */
279
/* chroot into the jail.
280
* Henceforth this process, and its children, cannot see anything above
281
* canoncial_jailpath. */
282
if (chroot(canonical_jailpath))
284
syslog(LOG_ERR, "chroot to %s failed\n", canonical_jailpath);
286
perror("could not chroot");
290
/* chdir into the specified working directory */
293
perror("could not chdir");
297
/* setuid to the given user ID.
298
* Henceforth we will be running as this user instead of root.
302
perror("could not setgid");
308
perror("could not setuid");
317
/* set user resource limits */
321
/* Process data segment in memory */
322
l.rlim_cur = 192 * 1024 * 1024; /* 192MiB */
323
l.rlim_max = 256 * 1024 * 1024; /* 256MiB */
324
if (setrlimit(RLIMIT_AS, &l))
326
perror("could not setrlimit/RLIMIT_AS");
333
if (setrlimit(RLIMIT_CORE, &l))
335
perror("could not setrlimit/RLIMIT_CORE");
342
if (setrlimit(RLIMIT_CPU, &l))
344
perror("could not setrlimit/RLIMIT_CPU");
349
l.rlim_cur = 64 * 1024 * 1024; /* 64Mb */
350
l.rlim_max = 72 * 1024 * 1024; /* 72Mb */
351
if (setrlimit(RLIMIT_FSIZE, &l))
353
perror("could not setrlimit/RLIMIT_FSIZE");
358
/* exec (replace this process with the a new instance of the target
359
* program). Pass along all the arguments.
360
* Note that for script execution, the "program" will be the interpreter,
361
* and the first argument will be the script. */
364
/* nb exec won't return unless there was an error */
365
syslog(LOG_ERR, "exec of %s in %s failed", prog, canonical_jailpath);
367
perror("could not exec");
added
removed
trampoline/trampoline.c
