int bus_machine_method_get_addresses(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; _cleanup_close_pair_ int pair[2] = { -1, -1 }; _cleanup_free_ char *us = NULL, *them = NULL; _cleanup_close_ int netns_fd = -1; Machine *m = userdata; const char *p; siginfo_t si; pid_t child; int r; assert(bus); assert(message); assert(m); r = readlink_malloc("/proc/self/ns/net", &us); if (r < 0) return sd_bus_error_set_errno(error, r); p = procfs_file_alloca(m->leader, "ns/net"); r = readlink_malloc(p, &them); if (r < 0) return sd_bus_error_set_errno(error, r); if (streq(us, them)) return sd_bus_error_setf(error, BUS_ERROR_NO_PRIVATE_NETWORKING, "Machine %s does not use private networking", m->name); r = namespace_open(m->leader, NULL, NULL, &netns_fd, NULL); if (r < 0) return sd_bus_error_set_errno(error, r); if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, pair) < 0) return sd_bus_error_set_errno(error, -errno); child = fork(); if (child < 0) return sd_bus_error_set_errno(error, -errno); if (child == 0) { _cleanup_free_ struct local_address *addresses = NULL; struct local_address *a; int i, n; pair[0] = safe_close(pair[0]); r = namespace_enter(-1, -1, netns_fd, -1); if (r < 0) _exit(EXIT_FAILURE); n = local_addresses(NULL, 0, &addresses); if (n < 0) _exit(EXIT_FAILURE); for (a = addresses, i = 0; i < n; a++, i++) { struct iovec iov[2] = { { .iov_base = &a->family, .iov_len = sizeof(a->family) }, { .iov_base = &a->address, .iov_len = FAMILY_ADDRESS_SIZE(a->family) }, };
int bus_container_connect_socket(sd_bus *b) { _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1; pid_t leader, child; siginfo_t si; int r; assert(b); assert(b->input_fd < 0); assert(b->output_fd < 0); r = container_get_leader(b->machine, &leader); if (r < 0) return r; r = namespace_open(leader, &pidnsfd, &mntnsfd, &rootfd); if (r < 0) return r; b->input_fd = socket(b->sockaddr.sa.sa_family, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0); if (b->input_fd < 0) return -errno; b->output_fd = b->input_fd; bus_socket_setup(b); child = fork(); if (child < 0) return -errno; if (child == 0) { pid_t grandchild; r = namespace_enter(pidnsfd, mntnsfd, rootfd); if (r < 0) _exit(255); /* We just changed PID namespace, however it will only * take effect on the children we now fork. Hence, * let's fork another time, and connect from this * grandchild, so that SO_PEERCRED of our connection * comes from a process from within the container, and * not outside of it */ grandchild = fork(); if (grandchild < 0) _exit(255); if (grandchild == 0) { r = connect(b->input_fd, &b->sockaddr.sa, b->sockaddr_size); if (r < 0) { if (errno == EINPROGRESS) _exit(1); _exit(255); } _exit(EXIT_SUCCESS); } r = wait_for_terminate(grandchild, &si); if (r < 0) _exit(255); if (si.si_code != CLD_EXITED) _exit(255); _exit(si.si_status); } r = wait_for_terminate(child, &si); if (r < 0) return r; if (si.si_code != CLD_EXITED) return -EIO; if (si.si_status == 1) return 1; if (si.si_status != EXIT_SUCCESS) return -EIO; return bus_socket_start_auth(b); }
int bus_container_connect_kernel(sd_bus *b) { _cleanup_close_pair_ int pair[2] = { -1, -1 }; _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1; union { struct cmsghdr cmsghdr; uint8_t buf[CMSG_SPACE(sizeof(int))]; } control = {}; struct msghdr mh = { .msg_control = &control, .msg_controllen = sizeof(control), }; struct cmsghdr *cmsg; pid_t leader, child; siginfo_t si; int r; _cleanup_close_ int fd = -1; assert(b); assert(b->input_fd < 0); assert(b->output_fd < 0); r = container_get_leader(b->machine, &leader); if (r < 0) return r; r = namespace_open(leader, &pidnsfd, &mntnsfd, &rootfd); if (r < 0) return r; if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0) return -errno; child = fork(); if (child < 0) return -errno; if (child == 0) { pid_t grandchild; pair[0] = safe_close(pair[0]); r = namespace_enter(pidnsfd, mntnsfd, rootfd); if (r < 0) _exit(EXIT_FAILURE); /* We just changed PID namespace, however it will only * take effect on the children we now fork. Hence, * let's fork another time, and connect from this * grandchild, so that kdbus only sees the credentials * of this process which comes from within the * container, and not outside of it */ grandchild = fork(); if (grandchild < 0) _exit(EXIT_FAILURE); if (grandchild == 0) { fd = open(b->kernel, O_RDWR|O_NOCTTY|O_CLOEXEC); if (fd < 0) _exit(EXIT_FAILURE); cmsg = CMSG_FIRSTHDR(&mh); cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; cmsg->cmsg_len = CMSG_LEN(sizeof(int)); memcpy(CMSG_DATA(cmsg), &fd, sizeof(int)); mh.msg_controllen = cmsg->cmsg_len; if (sendmsg(pair[1], &mh, MSG_NOSIGNAL) < 0) _exit(EXIT_FAILURE); _exit(EXIT_SUCCESS); } r = wait_for_terminate(grandchild, &si); if (r < 0) _exit(EXIT_FAILURE); if (si.si_code != CLD_EXITED) _exit(EXIT_FAILURE); _exit(si.si_status); } pair[1] = safe_close(pair[1]); r = wait_for_terminate(child, &si); if (r < 0) return r; if (si.si_code != CLD_EXITED) return -EIO; if (si.si_status != EXIT_SUCCESS) return -EIO; if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0) return -errno; for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { int *fds; unsigned n_fds; fds = (int*) CMSG_DATA(cmsg); n_fds = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int); if (n_fds != 1) { close_many(fds, n_fds); return -EIO; } fd = fds[0]; } b->input_fd = b->output_fd = fd; fd = -1; return bus_kernel_take_fd(b); }
int bus_machine_method_get_addresses(sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; Machine *m = userdata; int r; assert(message); assert(m); r = sd_bus_message_new_method_return(message, &reply); if (r < 0) return r; r = sd_bus_message_open_container(reply, 'a', "(iay)"); if (r < 0) return r; switch (m->class) { case MACHINE_HOST: { _cleanup_free_ struct local_address *addresses = NULL; struct local_address *a; int n, i; n = local_addresses(NULL, 0, AF_UNSPEC, &addresses); if (n < 0) return n; for (a = addresses, i = 0; i < n; a++, i++) { r = sd_bus_message_open_container(reply, 'r', "iay"); if (r < 0) return r; r = sd_bus_message_append(reply, "i", addresses[i].family); if (r < 0) return r; r = sd_bus_message_append_array(reply, 'y', &addresses[i].address, FAMILY_ADDRESS_SIZE(addresses[i].family)); if (r < 0) return r; r = sd_bus_message_close_container(reply); if (r < 0) return r; } break; } case MACHINE_CONTAINER: { _cleanup_close_pair_ int pair[2] = { -1, -1 }; _cleanup_free_ char *us = NULL, *them = NULL; _cleanup_close_ int netns_fd = -1; const char *p; siginfo_t si; pid_t child; r = readlink_malloc("/proc/self/ns/net", &us); if (r < 0) return r; p = procfs_file_alloca(m->leader, "ns/net"); r = readlink_malloc(p, &them); if (r < 0) return r; if (streq(us, them)) return sd_bus_error_setf(error, BUS_ERROR_NO_PRIVATE_NETWORKING, "Machine %s does not use private networking", m->name); r = namespace_open(m->leader, NULL, NULL, &netns_fd, NULL, NULL); if (r < 0) return r; if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, pair) < 0) return -errno; child = fork(); if (child < 0) return sd_bus_error_set_errnof(error, errno, "Failed to fork(): %m"); if (child == 0) { _cleanup_free_ struct local_address *addresses = NULL; struct local_address *a; int i, n; pair[0] = safe_close(pair[0]); r = namespace_enter(-1, -1, netns_fd, -1, -1); if (r < 0) _exit(EXIT_FAILURE); n = local_addresses(NULL, 0, AF_UNSPEC, &addresses); if (n < 0) _exit(EXIT_FAILURE); for (a = addresses, i = 0; i < n; a++, i++) { struct iovec iov[2] = { { .iov_base = &a->family, .iov_len = sizeof(a->family) }, { .iov_base = &a->address, .iov_len = FAMILY_ADDRESS_SIZE(a->family) }, }; r = writev(pair[1], iov, 2); if (r < 0) _exit(EXIT_FAILURE); } pair[1] = safe_close(pair[1]); _exit(EXIT_SUCCESS); }