1
/* IVLE - Informatics Virtual Learning Environment
2
* Copyright (C) 2007-2008 The University of Melbourne
4
* This program is free software; you can redistribute it and/or modify
5
* it under the terms of the GNU General Public License as published by
6
* the Free Software Foundation; either version 2 of the License, or
7
* (at your option) any later version.
9
* This program is distributed in the hope that it will be useful,
10
* but WITHOUT ANY WARRANTY; without even the implied warranty of
11
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
* GNU General Public License for more details.
14
* You should have received a copy of the GNU General Public License
15
* along with this program; if not, write to the Free Software
16
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19
* Author: Tom Conway, Matt Giuca
22
* This program runs a given program in a given working dir.
23
* First, it chroots to a jail path and setuids to a given user ID.
24
* This is intented to provide a safe execution environment for arbitrary
25
* programs and services.
27
* Scripts (such as Python programs) should be executed by supplying
28
* "/usr/bin/python" as the program, and the script as the first argument.
30
* Usage: trampoline uid jail-path working-path program [args...]
31
* Must run as root. Will safely setuid to the supplied uid, checking that it
32
* is not root. Recommended that the file is set up as follows:
33
* sudo chown root:root trampoline; sudo chroot +s trampoline
43
#include <sys/mount.h>
44
#include <sys/types.h>
47
#include <sys/resource.h>
51
/* conf.h is admin-configured by the setup process.
52
* It defines jail_base.
58
/* Returns TRUE if the given uid is allowed to execute trampoline.
59
* Only root or the web server should be allowed to execute.
60
* This is determined by the whitelist allowed_uids in conf.h.
62
int uid_allowed(int uid)
65
/* root is always allowed to execute trampoline */
68
/* loop over all allowed_uids */
69
for (i=(sizeof(allowed_uids)/sizeof(*allowed_uids))-1; i>=0; i--)
71
if (allowed_uids[i] == uid)
74
/* default to disallowing */
78
/* Turn the process into a daemon using the standard
85
/* already a daemon */
86
if ( getppid() == 1 ) return;
88
/* Fork off the parent process */
93
/* If we got a good PID, then we can exit the parent process. */
98
/* At this point we are executing as the child process */
100
/* Change the file mode mask */
103
/* Create a new SID for the child process */
109
/* Change the current working directory. This prevents the current
110
directory from being locked; hence not being able to remove it. */
111
if ((chdir("/")) < 0) {
115
/* Redirect standard files to /dev/null */
116
freopen( "/dev/null", "r", stdin);
117
freopen( "/dev/null", "w", stdout);
118
freopen( "/dev/null", "w", stderr);
121
static void usage(const char* nm)
124
"usage: %s [-d] [-u] <uid> <base> <src> <system> <jail> <cwd> <program> [args...]\n", nm);
128
#ifdef IVLE_AUFS_JAILS
129
/* Die more pleasantly if mallocs fail. */
130
void *die_if_null(void *ptr)
134
perror("not enough memory");
140
/* Find the path of the user components of a jail, given a mountpoint. */
141
char *jail_src(const char *jail_src_base, const char *jail_base,
142
const char *jailpath)
148
srclen = strlen(jail_src_base);
149
dstlen = strlen(jail_base);
151
src = die_if_null(malloc(strlen(jailpath) + (srclen - dstlen) + 1));
152
strcpy(src, jail_src_base);
153
strcat(src, jailpath+dstlen);
158
/* Check for the validity of a jail in the given path, mounting it if it looks
160
* TODO: Updating /etc/mtab would be nice. */
161
void mount_if_needed(const char *jail_src_base, const char *jail_base,
162
const char *jail_system, const char *jailpath)
168
/* Check if there is something useful in the jail. If not, it's probably
170
jaillib = die_if_null(malloc(strlen(jailpath) + 5));
171
sprintf(jaillib, "%s/lib", jailpath);
173
if (access(jaillib, F_OK))
175
/* No /lib? Mustn't be mounted. Mount it, creating the dir if needed. */
176
if (access(jailpath, F_OK))
178
if(mkdir(jailpath, 0755))
180
syslog(LOG_ERR, "could not create mountpoint %s\n", jailpath);
181
perror("could not create jail mountpoint");
184
syslog(LOG_NOTICE, "created mountpoint %s\n", jailpath);
187
jailsrc = jail_src(jail_src_base, jail_base, jailpath);
188
mountdata = die_if_null(malloc(3 + strlen(jailsrc) + 4 + strlen(jail_system) + 3 + 1));
189
sprintf(mountdata, "br:%s=rw:%s=ro", jailsrc, jail_system);
190
if (mount("none", jailpath, "aufs", 0, mountdata))
192
syslog(LOG_ERR, "could not mount %s\n", jailpath);
193
perror("could not mount");
197
syslog(LOG_INFO, "mounted %s\n", jailpath);
205
#endif /* IVLE_AUFS_JAILS */
207
/* Unsets any signal mask applied by the parent process */
208
int unmask_signals(void)
212
sigset = die_if_null(malloc(sizeof(sigset_t)));
214
result = sigprocmask(SIG_SETMASK, sigset, NULL);
216
printf("%d", result);
220
int main(int argc, char* const argv[])
233
char canonical_jailpath[PATH_MAX];
235
/* Disallow execution from all users but the whitelisted ones, and root */
236
if (!uid_allowed(getuid()))
238
fprintf(stderr, "only the web server may execute trampoline\n");
242
/* Args check and usage */
248
if (strcmp(argv[arg_num], "-d") == 0)
258
if (strcmp(argv[arg_num], "-u") == 0)
267
uid = atoi(argv[arg_num++]);
268
jail_base = argv[arg_num++];
269
jail_src_base = argv[arg_num++];
270
jail_system = argv[arg_num++];
271
jailpath = argv[arg_num++];
272
work_dir = argv[arg_num++];
273
prog = argv[arg_num];
274
args = argv + arg_num;
276
/* Disallow suiding to the root user */
279
fprintf(stderr, "cannot set up a jail as root\n");
283
/* Jail path must be an absolute path,
284
* and it must begin with jail_base.
286
if (norm(canonical_jailpath, PATH_MAX, jailpath) != 0)
288
fprintf(stderr, "bad jail path: %s\n", jailpath);
291
if (strncmp(canonical_jailpath, jail_base, strlen(jail_base)))
293
fprintf(stderr, "bad jail path: %s\n", jailpath);
297
openlog("trampoline", LOG_CONS | LOG_PID | LOG_NDELAY, LOG_USER);
299
#ifdef IVLE_AUFS_JAILS
300
mount_if_needed(jail_src_base, jail_base, jail_system, canonical_jailpath);
301
#endif /* IVLE_AUFS_JAILS */
303
/* chroot into the jail.
304
* Henceforth this process, and its children, cannot see anything above
305
* canoncial_jailpath. */
306
if (chroot(canonical_jailpath))
308
syslog(LOG_ERR, "chroot to %s failed\n", canonical_jailpath);
310
perror("could not chroot");
314
/* chdir into the specified working directory */
317
perror("could not chdir");
321
/* setuid to the given user ID.
322
* Henceforth we will be running as this user instead of root.
326
perror("could not setgid");
332
perror("could not setuid");
336
/* set user resource limits */
340
/* Process adress space in memory */
341
l.rlim_cur = 192 * 1024 * 1024; /* 192MiB */
342
l.rlim_max = 256 * 1024 * 1024; /* 256MiB */
343
if (setrlimit(RLIMIT_AS, &l))
345
perror("could not setrlimit/RLIMIT_AS");
349
/* Process data segment in memory
350
* Note: This requires a kernel patch to work correctly otherwise it is
351
* ineffective (thus you are only limited by RLIMIT_AS)
353
l.rlim_cur = 192 * 1024 * 1024; /* 192MiB */
354
l.rlim_max = 256 * 1024 * 1024; /* 256MiB */
355
if (setrlimit(RLIMIT_DATA, &l))
357
perror("could not setrlimit/RLIMIT_DATA");
362
l.rlim_cur = 0; /* No core files */
363
l.rlim_max = 0; /* No core files */
364
if (setrlimit(RLIMIT_CORE, &l))
366
perror("could not setrlimit/RLIMIT_CORE");
371
l.rlim_cur = 25; /* 25 Seconds */
372
l.rlim_max = 30; /* 30 Seconds */
373
if (setrlimit(RLIMIT_CPU, &l))
375
perror("could not setrlimit/RLIMIT_CPU");
380
l.rlim_cur = 64 * 1024 * 1024; /* 64MiB */
381
l.rlim_max = 72 * 1024 * 1024; /* 72MiB */
382
if (setrlimit(RLIMIT_FSIZE, &l))
384
perror("could not setrlimit/RLIMIT_FSIZE");
389
/* Remove any signal handler masks so we can send signals to the child */
392
perror("could not unmask signals");
396
/* If everything was OK daemonize (if required) */
402
/* exec (replace this process with the a new instance of the target
403
* program). Pass along all the arguments.
404
* Note that for script execution, the "program" will be the interpreter,
405
* and the first argument will be the script. */
408
/* nb exec won't return unless there was an error */
409
syslog(LOG_ERR, "exec of %s in %s failed", prog, canonical_jailpath);
411
perror("could not exec");
added
removed
bin/trampoline/trampoline.c
