diff --git a/cmdline.c b/cmdline.c index ae2c780..9430bf6 100644 --- a/cmdline.c +++ b/cmdline.c @@ -368,6 +368,7 @@ bool cmdlineParse(int argc, char* argv[], struct nsjconf_t* nsjconf) .iface_vs_gw = "0.0.0.0", .kafel_file = NULL, .kafel_string = NULL, + .orig_uid = getuid(), .num_cpus = sysconf(_SC_NPROCESSORS_ONLN), }; @@ -651,9 +652,8 @@ bool cmdlineParse(int argc, char* argv[], struct nsjconf_t* nsjconf) dst = dst ? dst : optarg; if (!mountAddMountPtTail(nsjconf, /* src= */ optarg, dst, /* fs_type= */ "", /* options= */ "", MS_BIND | MS_REC | MS_PRIVATE | MS_RDONLY, - /* isDir= */ - NS_DIR_MAYBE, /* mandatory= */ true, NULL, NULL, NULL, 0, - /* is_symlink= */ false)) { + /* isDir= */ NS_DIR_MAYBE, /* mandatory= */ true, NULL, NULL, NULL, + 0, /* is_symlink= */ false)) { return false; } }; break; @@ -662,18 +662,15 @@ bool cmdlineParse(int argc, char* argv[], struct nsjconf_t* nsjconf) dst = dst ? dst : optarg; if (!mountAddMountPtTail(nsjconf, /* src= */ optarg, dst, /* fs_type= */ "", /* options= */ "", MS_BIND | MS_REC | MS_PRIVATE, - /* isDir= */ NS_DIR_MAYBE, - /* mandatory= */ true, NULL, NULL, NULL, 0, - /* is_symlink= */ - false)) { + /* isDir= */ NS_DIR_MAYBE, /* mandatory= */ true, NULL, NULL, NULL, + 0, /* is_symlink= */ false)) { return false; } }; break; case 'T': { if (!mountAddMountPtTail(nsjconf, /* src= */ NULL, optarg, "tmpfs", - /* options= */ "", - /* flags= */ 0, /* isDir= */ true, /* mandatory= */ true, NULL, - NULL, NULL, 0, + /* options= */ "", /* flags= */ 0, /* isDir= */ NS_DIR_YES, + /* mandatory= */ true, NULL, NULL, NULL, 0, /* is_symlink= */ false)) { return false; } @@ -752,7 +749,7 @@ bool cmdlineParse(int argc, char* argv[], struct nsjconf_t* nsjconf) if (nsjconf->mount_proc) { if (!mountAddMountPtTail(nsjconf, /* src= */ NULL, nsjconf->proc_path, "proc", "", - nsjconf->is_proc_rw ? 0 : MS_RDONLY, /* isDir= */ true, + nsjconf->is_proc_rw ? 0 : MS_RDONLY, /* isDir= */ NS_DIR_YES, /* mandatory= */ true, NULL, NULL, NULL, 0, /* is_symlink= */ false)) { return false; } @@ -762,13 +759,13 @@ bool cmdlineParse(int argc, char* argv[], struct nsjconf_t* nsjconf) /* options= */ "", nsjconf->is_root_rw ? (MS_BIND | MS_REC | MS_PRIVATE) : (MS_BIND | MS_REC | MS_PRIVATE | MS_RDONLY), - /* isDir= */ true, /* mandatory= */ true, NULL, NULL, NULL, 0, + /* isDir= */ NS_DIR_YES, /* mandatory= */ true, NULL, NULL, NULL, 0, /* is_symlink= */ false)) { return false; } } else { if (!mountAddMountPtHead(nsjconf, /* src= */ NULL, "/", "tmpfs", /* options= */ "", - nsjconf->is_root_rw ? 0 : MS_RDONLY, /* isDir= */ true, + nsjconf->is_root_rw ? 0 : MS_RDONLY, /* isDir= */ NS_DIR_YES, /* mandatory= */ true, NULL, NULL, NULL, 0, /* is_symlink= */ false)) { return false; } diff --git a/mount.c b/mount.c index 7cce75d..1269f75 100644 --- a/mount.c +++ b/mount.c @@ -266,9 +266,9 @@ static bool mountMkdirAndTest(const char* dir) return true; } -static bool mountGetDir(char* dir, const char* name) +static bool mountGetDir(struct nsjconf_t* nsjconf, char* dir, const char* name) { - snprintf(dir, PATH_MAX, "/dev/shm/nsjail.%s", name); + snprintf(dir, PATH_MAX, "/run/user/%u/nsjail.%s", nsjconf->orig_uid, name); if (mountMkdirAndTest(dir)) { return true; } @@ -278,11 +278,15 @@ static bool mountGetDir(char* dir, const char* name) } const char* tmp = getenv("TMPDIR"); if (tmp) { - snprintf(dir, PATH_MAX, "%s/nsjail.%s", name, tmp); + snprintf(dir, PATH_MAX, "%s/nsjail.%s", tmp, name); if (mountMkdirAndTest(dir)) { return true; } } + snprintf(dir, PATH_MAX, "/dev/shm/nsjail.%s", name); + if (mountMkdirAndTest(dir)) { + return true; + } snprintf(dir, PATH_MAX, "/tmp/nsjail.%s.%" PRIx64, name, utilRnd64()); if (mountMkdirAndTest(dir)) { return true; @@ -321,7 +325,7 @@ static bool mountInitNsInternal(struct nsjconf_t* nsjconf) } char destdir[PATH_MAX]; - if (mountGetDir(destdir, "root") == false) { + if (mountGetDir(nsjconf, destdir, "root") == false) { LOG_E("Couldn't obtain root mount directories"); return false; } @@ -337,7 +341,7 @@ static bool mountInitNsInternal(struct nsjconf_t* nsjconf) } char tmpdir[PATH_MAX]; - if (mountGetDir(tmpdir, "tmp") == false) { + if (mountGetDir(nsjconf, tmpdir, "tmp") == false) { LOG_E("Couldn't obtain temporary mount directories"); return false; } diff --git a/mount.h b/mount.h index c68a118..c068888 100644 --- a/mount.h +++ b/mount.h @@ -28,7 +28,7 @@ #include "nsjail.h" typedef enum { - NS_DIR_NO = 0, + NS_DIR_NO = 0x100, NS_DIR_YES, NS_DIR_MAYBE, } isDir_t; diff --git a/nsjail.h b/nsjail.h index 910bc1d..2eb7459 100644 --- a/nsjail.h +++ b/nsjail.h @@ -160,8 +160,8 @@ struct nsjconf_t { size_t cgroup_pids_max; FILE* kafel_file; char* kafel_string; - uid_t orig_euid; long num_cpus; + uid_t orig_uid; TAILQ_HEAD(udmaplist, idmap_t) uids; TAILQ_HEAD(gdmaplist, idmap_t)