1
/* vi: set sw=4 ts=4: */
3
* Mini nsenter implementation for busybox.
5
* Copyright (C) 2016 by Bartosz Golaszewski <bartekgola@gmail.com>
7
* Licensed under GPLv2 or later, see file LICENSE in this source tree.
9
//config:config NSENTER
10
//config: bool "nsenter (6.5 kb)"
13
//config: Run program with namespaces of other processes.
15
//applet:IF_NSENTER(APPLET(nsenter, BB_DIR_USR_BIN, BB_SUID_DROP))
17
//kbuild:lib-$(CONFIG_NSENTER) += nsenter.o
19
//usage:#define nsenter_trivial_usage
20
//usage: "[OPTIONS] [PROG ARGS]"
21
//usage:#define nsenter_full_usage "\n"
22
//usage: "\n -t PID Target process to get namespaces from"
23
//usage: "\n -m[FILE] Enter mount namespace"
24
//usage: "\n -u[FILE] Enter UTS namespace (hostname etc)"
25
//usage: "\n -i[FILE] Enter System V IPC namespace"
26
//usage: "\n -n[FILE] Enter network namespace"
27
//usage: "\n -p[FILE] Enter pid namespace"
28
//usage: "\n -U[FILE] Enter user namespace"
29
//usage: "\n -S UID Set uid in entered namespace"
30
//usage: "\n -G GID Set gid in entered namespace"
31
//usage: IF_LONG_OPTS(
32
//usage: "\n --preserve-credentials Don't touch uids or gids"
34
//usage: "\n -r[DIR] Set root directory"
35
//usage: "\n -w[DIR] Set working directory"
36
//usage: "\n -F Don't fork before exec'ing PROG"
40
# define CLONE_NEWUTS 0x04000000
43
# define CLONE_NEWIPC 0x08000000
46
# define CLONE_NEWUSER 0x10000000
49
# define CLONE_NEWPID 0x20000000
52
# define CLONE_NEWNET 0x40000000
57
struct namespace_descr {
58
int flag; /* value passed to setns() */
59
char ns_nsfile8[8]; /* "ns/" + namespace file in process' procfs entry */
62
struct namespace_ctx {
63
char *path; /* optional path to a custom ns file */
64
int fd; /* opened namespace file descriptor */
80
OPT_prescred = (1 << 12) * ENABLE_LONG_OPTS,
92
* The order is significant in nsenter.
93
* The user namespace comes first, so that it is entered first.
94
* This gives an unprivileged user the potential to enter other namespaces.
96
static const struct namespace_descr ns_list[] ALIGN_INT = {
97
{ CLONE_NEWUSER, "ns/user", },
98
{ CLONE_NEWIPC, "ns/ipc", },
99
{ CLONE_NEWUTS, "ns/uts", },
100
{ CLONE_NEWNET, "ns/net", },
101
{ CLONE_NEWPID, "ns/pid", },
102
{ CLONE_NEWNS, "ns/mnt", },
105
* Upstream nsenter doesn't support the short option for --preserve-credentials
106
* "+": stop on first non-option
108
static const char opt_str[] ALIGN1 = "+""U::i::u::n::p::m::""t:+S:+G:+r::w::F";
111
static const char nsenter_longopts[] ALIGN1 =
112
"user\0" Optional_argument "U"
113
"ipc\0" Optional_argument "i"
114
"uts\0" Optional_argument "u"
115
"net\0" Optional_argument "n"
116
"pid\0" Optional_argument "p"
117
"mount\0" Optional_argument "m"
118
"target\0" Required_argument "t"
119
"setuid\0" Required_argument "S"
120
"setgid\0" Required_argument "G"
121
"root\0" Optional_argument "r"
122
"wd\0" Optional_argument "w"
123
"no-fork\0" No_argument "F"
124
"preserve-credentials\0" No_argument "\xff"
129
* Open a file and return the new descriptor. If a full path is provided in
130
* fs_path, then the file to which it points is opened. Otherwise (fd_path is
131
* NULL) the routine builds a path to a procfs file using the following
132
* template: '/proc/<target_pid>/<target_file>'.
134
static int open_by_path_or_target(const char *path,
135
pid_t target_pid, const char *target_file)
137
char proc_path_buf[sizeof("/proc/%u/1234567890") + sizeof(int)*3];
140
if (target_pid == 0) {
142
* "nsenter -p PROG" - neither -pFILE nor -tPID given.
146
snprintf(proc_path_buf, sizeof(proc_path_buf),
147
"/proc/%u/%s", (unsigned)target_pid, target_file);
148
path = proc_path_buf;
151
return xopen(path, O_RDONLY);
154
int nsenter_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
155
int nsenter_main(int argc UNUSED_PARAM, char **argv)
159
const char *root_dir_str = NULL;
160
const char *wd_str = NULL;
161
struct namespace_ctx ns_ctx_list[NS_COUNT];
162
int setgroups_failed;
168
memset(ns_ctx_list, 0, sizeof(ns_ctx_list));
170
opts = getopt32long(argv, opt_str, nsenter_longopts,
171
&ns_ctx_list[NS_USR_POS].path,
172
&ns_ctx_list[NS_IPC_POS].path,
173
&ns_ctx_list[NS_UTS_POS].path,
174
&ns_ctx_list[NS_NET_POS].path,
175
&ns_ctx_list[NS_PID_POS].path,
176
&ns_ctx_list[NS_MNT_POS].path,
177
&target_pid, &uid, &gid,
178
&root_dir_str, &wd_str
182
root_fd = wd_fd = -1;
184
root_fd = open_by_path_or_target(root_dir_str,
187
wd_fd = open_by_path_or_target(wd_str, target_pid, "cwd");
189
for (i = 0; i < NS_COUNT; i++) {
190
const struct namespace_descr *ns = &ns_list[i];
191
struct namespace_ctx *ns_ctx = &ns_ctx_list[i];
195
ns_ctx->fd = open_by_path_or_target(ns_ctx->path,
196
target_pid, ns->ns_nsfile8);
200
* Entering the user namespace without --preserve-credentials implies
201
* --setuid & --setgid and clearing root's groups.
203
setgroups_failed = 0;
204
if ((opts & OPT_user) && !(opts & OPT_prescred)) {
205
opts |= (OPT_setuid | OPT_setgid);
207
* We call setgroups() before and after setns() and only
208
* bail-out if it fails twice.
210
setgroups_failed = (setgroups(0, NULL) < 0);
213
for (i = 0; i < NS_COUNT; i++) {
214
const struct namespace_descr *ns = &ns_list[i];
215
struct namespace_ctx *ns_ctx = &ns_ctx_list[i];
219
if (setns(ns_ctx->fd, ns->flag)) {
220
bb_perror_msg_and_die(
221
"setns(): can't reassociate to namespace '%s'",
222
ns->ns_nsfile8 + 3 /* skip over "ns/" */
225
close(ns_ctx->fd); /* should close fds, to not confuse exec'ed PROG */
232
* Save the current working directory if we're not
235
wd_fd = xopen(".", O_RDONLY);
250
* Entering the pid namespace implies forking unless it's been
251
* explicitly requested by the user not to.
253
if (!(opts & OPT_nofork) && (opts & OPT_pid)) {
254
xvfork_parent_waits_and_exits();
255
/* Child continues */
258
if (opts & OPT_setgid) {
259
if (setgroups(0, NULL) < 0 && setgroups_failed)
260
bb_simple_perror_msg_and_die("setgroups");
263
if (opts & OPT_setuid)
266
exec_prog_or_SHELL(argv);
added
removed
.pc/platform-linux.diff/util-linux/nsenter.c
