varnish-cache/bin/varnishd/mgt/mgt_jail.c
1
/*-
2
 * Copyright (c) 2015 Varnish Software AS
3
 * All rights reserved.
4
 *
5
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6
 *
7
 * Redistribution and use in source and binary forms, with or without
8
 * modification, are permitted provided that the following conditions
9
 * are met:
10
 * 1. Redistributions of source code must retain the above copyright
11
 *    notice, this list of conditions and the following disclaimer.
12
 * 2. Redistributions in binary form must reproduce the above copyright
13
 *    notice, this list of conditions and the following disclaimer in the
14
 *    documentation and/or other materials provided with the distribution.
15
 *
16
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
20
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26
 * SUCH DAMAGE.
27
 *
28
 * Jailing
29
 *
30
 */
31
32
#include "config.h"
33
34
#include <errno.h>
35
#include <fcntl.h>
36
#include <stdio.h>
37
#include <stdlib.h>
38
#include <string.h>
39
#include <unistd.h>
40
#include <sys/stat.h>
41
42
#include "mgt/mgt.h"
43
#include "common/heritage.h"
44
#include "vav.h"
45
46
/**********************************************************************
47
 * A "none" jail implementation which doesn't do anything.
48
 */
49
50
static int v_matchproto_(jail_init_f)
51 745
vjn_init(char **args)
52
{
53 745
        if (args != NULL && *args != NULL)
54 0
                ARGV_ERR("-jnone takes no arguments.\n");
55 745
        return (0);
56
}
57
58
static void v_matchproto_(jail_master_f)
59 19986
vjn_master(enum jail_master_e jme)
60
{
61
        (void)jme;
62 19986
}
63
64
static void v_matchproto_(jail_subproc_f)
65 3461
vjn_subproc(enum jail_subproc_e jse)
66
{
67
        (void)jse;
68 3461
}
69
70
static const struct jail_tech jail_tech_none = {
71
        .magic =        JAIL_TECH_MAGIC,
72
        .name =         "none",
73
        .init =         vjn_init,
74
        .master =       vjn_master,
75
        .subproc =      vjn_subproc,
76
};
77
78
/**********************************************************************/
79
80
static const struct jail_tech *vjt;
81
82
static const struct choice vj_choice[] = {
83
#ifdef HAVE_SETPPRIV
84
        { "solaris",    &jail_tech_solaris },
85
#endif
86
        { "unix",       &jail_tech_unix },
87
        { "none",       &jail_tech_none },
88
        { NULL,         NULL },
89
};
90
91
void
92 772
VJ_Init(const char *j_arg)
93
{
94
        char **av;
95
        int i;
96
97 772
        if (j_arg != NULL) {
98 11
                av = VAV_Parse(j_arg, NULL, ARGV_COMMA);
99 11
                AN(av);
100 11
                if (av[0] != NULL)
101 0
                        ARGV_ERR("-j argument: %s\n", av[0]);
102 11
                if (av[1] == NULL)
103 0
                        ARGV_ERR("-j argument is emtpy\n");
104 11
                vjt = MGT_Pick(vj_choice, av[1], "jail");
105 9
                CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
106 9
                (void)vjt->init(av + 2);
107 4
                VAV_Free(av);
108
        } else {
109
                /*
110
                 * Go through list of jail technologies until one
111
                 * succeeds, falling back to "none".
112
                 */
113 1506
                for (i = 0; vj_choice[i].name != NULL; i++) {
114 1506
                        vjt = vj_choice[i].ptr;
115 1506
                        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
116 1506
                        if (!vjt->init(NULL))
117 761
                                break;
118
                }
119
        }
120 765
        VSB_printf(vident, ",-j%s", vjt->name);
121 765
}
122
123
void
124 20401
VJ_master(enum jail_master_e jme)
125
{
126 20401
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
127 20401
        vjt->master(jme);
128 20401
}
129
130
void
131 3492
VJ_subproc(enum jail_subproc_e jse)
132
{
133 3492
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
134 3492
        vjt->subproc(jse);
135 3492
}
136
137
int
138 719
VJ_make_workdir(const char *dname)
139
{
140
        int i;
141
142 719
        AN(dname);
143 719
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
144 719
        if (vjt->make_workdir != NULL) {
145 16
                i = vjt->make_workdir(dname, NULL, NULL);
146 16
                if (i)
147 0
                        return (i);
148 16
                VJ_master(JAIL_MASTER_FILE);
149
        } else {
150 703
                VJ_master(JAIL_MASTER_FILE);
151 703
                if (mkdir(dname, 0755) < 0 && errno != EEXIST)
152 0
                        ARGV_ERR("Cannot create working directory '%s': %s\n",
153
                                 dname, strerror(errno));
154
        }
155
156 719
        if (chdir(dname) < 0)
157 0
                ARGV_ERR("Cannot change to working directory '%s': %s\n",
158
                    dname, strerror(errno));
159
160 719
        i = open("_.testfile", O_RDWR|O_CREAT|O_EXCL, 0600);
161 719
        if (i < 0)
162 0
                ARGV_ERR("Cannot create test-file in %s (%s)\n"
163
                    "Check permissions (or delete old directory)\n",
164
                    dname, strerror(errno));
165 719
        closefd(&i);
166 719
        AZ(unlink("_.testfile"));
167 719
        VJ_master(JAIL_MASTER_LOW);
168 719
        return (0);
169
}
170
171
int
172 1783
VJ_make_subdir(const char *dname, const char *what, struct vsb *vsb)
173
{
174
        int e;
175
176 1783
        AN(dname);
177 1783
        AN(what);
178 1783
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
179 1783
        if (vjt->make_subdir != NULL)
180 32
                return (vjt->make_subdir(dname, what, vsb));
181
182 1751
        if (mkdir(dname, 0755) < 0 && errno != EEXIST) {
183 0
                e = errno;
184 0
                if (vsb != NULL) {
185 0
                        VSB_printf(vsb,
186
                            "Cannot create %s directory '%s': %s\n",
187
                            what, dname, strerror(e));
188
                } else {
189 0
                        MGT_Complain(C_ERR,
190
                            "Cannot create %s directory '%s': %s",
191
                            what, dname, strerror(e));
192
                }
193 0
                return (1);
194
        }
195 1751
        return (0);
196
}
197
198
void
199 1442
VJ_fix_fd(int fd, enum jail_fixfd_e what)
200
{
201
202 1442
        CHECK_OBJ_NOTNULL(vjt, JAIL_TECH_MAGIC);
203 1442
        if (vjt->fixfd != NULL)
204 32
                vjt->fixfd(fd, what);
205 1442
}