varnish-cache/bin/varnishd/mgt/mgt_jail.c
1
/*-
2
 * Copyright (c) 2015 Varnish Software AS
3
 * All rights reserved.
4
 *
5
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6
 *
7
 * Redistribution and use in source and binary forms, with or without
8
 * modification, are permitted provided that the following conditions
9
 * are met:
10
 * 1. Redistributions of source code must retain the above copyright
11
 *    notice, this list of conditions and the following disclaimer.
12
 * 2. Redistributions in binary form must reproduce the above copyright
13
 *    notice, this list of conditions and the following disclaimer in the
14
 *    documentation and/or other materials provided with the distribution.
15
 *
16
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
20
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26
 * SUCH DAMAGE.
27
 *
28
 * Jailing
29
 *
30
 */
31
32
#include "config.h"
33
34
#include <errno.h>
35
#include <fcntl.h>
36
#include <stdio.h>
37
#include <stdlib.h>
38
#include <string.h>
39
#include <unistd.h>
40
#include <sys/stat.h>
41
42
#include "mgt/mgt.h"
43
#include "common/heritage.h"
44
#include "vav.h"
45
46
/**********************************************************************
47
 * A "none" jail implementation which doesn't do anything.
48
 */
49
50
static int v_matchproto_(jail_init_f)
51 1496
vjn_init(char **args)
52
{
53 1496
        if (args != NULL && *args != NULL)
54 0
                ARGV_ERR("-jnone takes no arguments.\n");
55 1496
        return (0);
56
}
57
58
static void v_matchproto_(jail_master_f)
59 40176
vjn_master(enum jail_master_e jme)
60
{
61
        (void)jme;
62 40176
}
63
64
static void v_matchproto_(jail_subproc_f)
65 6994
vjn_subproc(enum jail_subproc_e jse)
66
{
67
        (void)jse;
68 6994
}
69
70
static const struct jail_tech jail_tech_none = {
71
        .magic =        JAIL_TECH_MAGIC,
72
        .name =         "none",
73
        .init =         vjn_init,
74
        .master =       vjn_master,
75
        .subproc =      vjn_subproc,
76
};
77
78
/**********************************************************************/
79
80
static const struct jail_tech *vjt;
81
82
static const struct choice vj_choice[] = {
83
#ifdef HAVE_SETPPRIV
84
        { "solaris",    &jail_tech_solaris },
85
#endif
86
        { "unix",       &jail_tech_unix },
87
        { "none",       &jail_tech_none },
88
        { NULL,         NULL },
89
};
90
91
void
92 1536
VJ_Init(const char *j_arg)
93
{
94
        char **av;
95
        int i;
96
97 1536
        if (j_arg != NULL) {
98 20
                av = VAV_Parse(j_arg, NULL, ARGV_COMMA);
99 20
                AN(av);
100 20
                if (av[0] != NULL)
101 0
                        ARGV_ERR("-j argument: %s\n", av[0]);
102 20
                if (av[1] == NULL)
103 0
                        ARGV_ERR("-j argument is emtpy\n");
104 20
                vjt = MGT_Pick(vj_choice, av[1], "jail");
105 18
                CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
106 18
                (void)vjt->init(av + 2);
107 8
                VAV_Free(av);
108
        } else {
109
                /*
110
                 * Go through list of jail technologies until one
111
                 * succeeds, falling back to "none".
112
                 */
113 3012
                for (i = 0; vj_choice[i].name != NULL; i++) {
114 3012
                        vjt = vj_choice[i].ptr;
115 3012
                        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
116 3012
                        if (!vjt->init(NULL))
117 1516
                                break;
118
                }
119
        }
120 1524
        VSB_printf(vident, ",-j%s", vjt->name);
121 1524
}
122
123
void
124 40988
VJ_master(enum jail_master_e jme)
125
{
126 40988
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
127 40988
        vjt->master(jme);
128 40988
}
129
130
void
131 7050
VJ_subproc(enum jail_subproc_e jse)
132
{
133 7050
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
134 7050
        vjt->subproc(jse);
135 7050
}
136
137
int
138 1440
VJ_make_workdir(const char *dname)
139
{
140
        int i;
141
142 1440
        AN(dname);
143 1440
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
144 1440
        if (vjt->make_workdir != NULL) {
145 28
                i = vjt->make_workdir(dname, NULL, NULL);
146 28
                if (i)
147 0
                        return (i);
148 28
                VJ_master(JAIL_MASTER_FILE);
149
        } else {
150 1412
                VJ_master(JAIL_MASTER_FILE);
151 1412
                if (mkdir(dname, 0755) < 0 && errno != EEXIST)
152 0
                        ARGV_ERR("Cannot create working directory '%s': %s\n",
153
                                 dname, strerror(errno));
154
        }
155
156 1440
        if (chdir(dname) < 0)
157 0
                ARGV_ERR("Cannot change to working directory '%s': %s\n",
158
                    dname, strerror(errno));
159
160 1440
        i = open("_.testfile", O_RDWR|O_CREAT|O_EXCL, 0600);
161 1440
        if (i < 0)
162 0
                ARGV_ERR("Cannot create test-file in %s (%s)\n"
163
                    "Check permissions (or delete old directory)\n",
164
                    dname, strerror(errno));
165 1440
        closefd(&i);
166 1440
        AZ(unlink("_.testfile"));
167 1440
        VJ_master(JAIL_MASTER_LOW);
168 1440
        return (0);
169
}
170
171
int
172 3586
VJ_make_subdir(const char *dname, const char *what, struct vsb *vsb)
173
{
174
        int e;
175
176 3586
        AN(dname);
177 3586
        AN(what);
178 3586
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
179 3586
        if (vjt->make_subdir != NULL)
180 56
                return (vjt->make_subdir(dname, what, vsb));
181
182 3530
        if (mkdir(dname, 0755) < 0 && errno != EEXIST) {
183 0
                e = errno;
184 0
                if (vsb != NULL) {
185 0
                        VSB_printf(vsb,
186
                            "Cannot create %s directory '%s': %s\n",
187
                            what, dname, strerror(e));
188
                } else {
189 0
                        MGT_Complain(C_ERR,
190
                            "Cannot create %s directory '%s': %s",
191
                            what, dname, strerror(e));
192
                }
193 0
                return (1);
194
        }
195 3530
        return (0);
196
}
197
198
void
199 2896
VJ_fix_fd(int fd, enum jail_fixfd_e what)
200
{
201
202 2896
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
203 2896
        if (vjt->fixfd != NULL)
204 64
                vjt->fixfd(fd, what);
205 2896
}