/
fundamental_devices.c
172 lines (156 loc) · 5.35 KB
/
fundamental_devices.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>
#ifdef _USE_MOUNT_LOFS_INSTEAD_OF_MKNOD
#include <sys/mntent.h>
#include <sys/mount.h>
#endif
#include "userchroot.h"
#include "fundamental_devices.h"
static void create_fundamental_device(const char* chroot_path,
const char* device_path) {
int rc;
struct stat realdev;
struct stat chrtdev;
int name_size = strlen(chroot_path) + strlen(device_path) + 1;
char* final_path = malloc(name_size);
if (final_path == NULL) {
fprintf(stderr,"Failed to allocate memory. Aborting.\n");
exit(ERR_EXIT_CODE);
}
rc = snprintf(final_path, name_size, "%s%s", chroot_path, device_path);
if (rc < 0) {
fprintf(stderr,"Failed to produce full path for device. Aborting.\n");
exit(ERR_EXIT_CODE);
}
rc = stat(final_path, &chrtdev);
if (!rc) {
fprintf(stderr,"%s already exists. Aborting.\n", final_path);
exit(ERR_EXIT_CODE);
}
rc = stat(device_path, &realdev);
if (rc) {
fprintf(stderr,"Failed to stat %s: %s. Aborting.\n",
device_path, strerror(errno));
exit(ERR_EXIT_CODE);
}
// we need to let the devices be created with the appropriate
// modes. However, since the file will be group-owned by
// the user creating the device, we make sure the new mount permissions
// prevent the user from having any permission granted just by the group.
// Clear out existing group permission bits
mode_t device_mode = realdev.st_mode & (~S_IRWXG);
// Set new group permission bits to be identical to other's permission bits
device_mode = device_mode | ((device_mode & S_IRWXO) << 3);
#ifdef _USE_MOUNT_LOFS_INSTEAD_OF_MKNOD
char mount_optbuf[MAX_MNTOPT_STR] = { '\0', };
rc = mkdir(final_path, device_mode);
if (rc) {
fprintf(stderr,"Failed to mkdir %s: %s. Aborting.\n",
final_path, strerror(errno));
}
rc = mount(device_path, final_path, MS_DATA|MS_OPTIONSTR,
MNTTYPE_LOFS, NULL, 0, mount_optbuf, MAX_MNTOPT_STR);
if (rc) {
fprintf(stderr,"Failed to lofs mount %s: %s",
final_path, strerror(errno));
exit(ERR_EXIT_CODE);
}
#else
rc = mknod(final_path, device_mode, realdev.st_rdev);
if (rc) {
fprintf(stderr,"Failed to create the device for %s: %s",
final_path, strerror(errno));
exit(ERR_EXIT_CODE);
}
#endif // _USE_MOUNT_LOFS_INSTEAD_OF_MKNOD
free(final_path);
}
static int unlink_fundamental_device(const char* chroot_path,
const char* device_path) {
int rc;
int name_size = strlen(chroot_path) + strlen(device_path) + 1;
char* final_path = malloc(name_size);
if (final_path == NULL) {
fprintf(stderr,"Failed to allocate memory.\n");
return 1;
}
rc = snprintf(final_path, name_size, "%s%s", chroot_path, device_path);
if (rc < 0) {
fprintf(stderr,"Failed to produce full path for device.\n");
free(final_path);
return 1;
}
#ifdef _USE_MOUNT_LOFS_INSTEAD_OF_MKNOD
rc = umount(final_path);
if (rc) {
fprintf(stderr,"Failed to umount %s: %s.\n",
final_path, strerror(errno));
free(final_path);
return 1;
}
rc = rmdir(final_path);
if (rc) {
fprintf(stderr,"Failed to rmdir %s: %s.\n",
final_path, strerror(errno));
free(final_path);
return 1;
}
rc = rmdir(final_path);
#else
rc = unlink(final_path);
if (rc) {
fprintf(stderr,"Failed to unlink %s: %s.\n",
final_path, strerror(errno));
free(final_path);
return 1;
}
#endif // _USE_MOUNT_LOFS_INSTEAD_OF_MKNOD
free(final_path);
return 0;
}
int create_fundamental_devices(const char* chroot_path) {
mode_t original_mask = umask(0000);
create_fundamental_device(chroot_path,"/dev/null");
create_fundamental_device(chroot_path,"/dev/zero");
create_fundamental_device(chroot_path,"/dev/random");
create_fundamental_device(chroot_path,"/dev/urandom");
// add mount for /dev/poll on Solaris
#if defined(sun) || defined(__sun)
create_fundamental_device(chroot_path,"/dev/poll");
#endif
umask(original_mask);
return 0;
}
int unlink_fundamental_devices(const char* chroot_path) {
int err = 0;
err |= unlink_fundamental_device(chroot_path,"/dev/null");
err |= unlink_fundamental_device(chroot_path,"/dev/zero");
err |= unlink_fundamental_device(chroot_path,"/dev/random");
err |= unlink_fundamental_device(chroot_path,"/dev/urandom");
// unmount /dev/poll on Solaris
#if defined(sun) || defined(__sun)
err |= unlink_fundamental_device(chroot_path,"/dev/poll");
#endif
return err ? ERR_EXIT_CODE : 0;
}
// ----------------------------------------------------------------------------
// Copyright 2015 Bloomberg Finance L.P.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// ----------------------------- END-OF-FILE ----------------------------------