picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

exec: introduce PrivateNetwork= process option to turn off network access to specific services

This commit is contained in:
Lennart Poettering 2011-08-02 05:24:58 +02:00
parent 4f755fc6ab
commit ff01d048b4
10 changed files with 59 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
TODO
View File

@ -19,6 +19,8 @@ Bugfixes:
Features:
* hide PAM/TCPWrap options in fragment parser when compile time disabled
* make arbitrary cgroups attributes settable
* when we automatically restart a service, ensure we retsart its rdeps, too.

2
man/systemd-nspawn.xml
View File

@ -155,7 +155,7 @@
</varlistentry>
<varlistentry>
<term><option>--no-net</option></term>
<term><option>--private-network</option></term>
<listitem><para>Turn off networking in
the container. This makes all network

26
man/systemd.exec.xml
View File

@ -783,9 +783,9 @@
<term><varname>PrivateTmp=</varname></term>
<listitem><para>Takes a boolean
argument. If true sets up a new
namespace for the executed processes
and mounts a private
argument. If true sets up a new file
system namespace for the executed
processes and mounts a private
<filename>/tmp</filename> directory
inside it, that is not shared by
processes outside of the
@ -794,7 +794,25 @@
process, but makes sharing between
processes via
<filename>/tmp</filename>
impossible. Defaults to false.</para></listitem>
impossible. Defaults to
false.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>PrivateNetwork=</varname></term>
<listitem><para>Takes a boolean
argument. If true sets up a new
network namespace for the executed
processes and configures only the
loopback network device
<literal>lo</literal> inside it. No
other network devices will be
available to the executed process.
This is useful to securely turn off
network access by the executed
process. Defaults to
false.</para></listitem>
</varlistentry>
<varlistentry>

4
src/dbus-execute.h
View File

@ -92,7 +92,8 @@
" <property name=\"KillMode\" type=\"s\" access=\"read\"/>\n" \
" <property name=\"KillSignal\" type=\"i\" access=\"read\"/>\n" \
" <property name=\"UtmpIdentifier\" type=\"s\" access=\"read\"/>\n" \
" <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n"
" <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" \
" <property name=\"PrivateNetwork\" type=\"b\" access=\"read\"/>\n"
#define BUS_EXEC_COMMAND_INTERFACE(name) \
" <property name=\"" name "\" type=\"a(sasbttuii)\" access=\"read\"/>\n"
@ -151,6 +152,7 @@
{ interface, "InaccessibleDirectories", bus_property_append_strv, "as", (context).inaccessible_dirs }, \
{ interface, "MountFlags", bus_property_append_ul, "t", &(context).mount_flags }, \
{ interface, "PrivateTmp", bus_property_append_bool, "b", &(context).private_tmp }, \
{ interface, "PrivateNetwork", bus_property_append_bool, "b", &(context).private_network }, \
{ interface, "SameProcessGroup", bus_property_append_bool, "b", &(context).same_pgrp }, \
{ interface, "KillMode", bus_execute_append_kill_mode, "s", &(context).kill_mode }, \
{ interface, "KillSignal", bus_property_append_int, "i", &(context).kill_signal }, \

15
src/execute.c
View File

@ -56,6 +56,7 @@
#include "missing.h"
#include "utmp-wtmp.h"
#include "def.h"
#include "loopback-setup.h"
/* This assumes there is a 'tty' group */
#define TTY_MODE 0620
@ -1208,6 +1209,14 @@ int exec_spawn(ExecCommand *command,
}
}
#endif
if (context->private_network) {
if (unshare(CLONE_NEWNET) < 0) {
r = EXIT_NETWORK;
goto fail_child;
}
loopback_setup();
}
if (strv_length(context->read_write_dirs) > 0 ||
strv_length(context->read_only_dirs) > 0 ||
@ -1594,13 +1603,15 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
"%sRootDirectory: %s\n"
"%sNonBlocking: %s\n"
"%sPrivateTmp: %s\n"
"%sControlGroupModify: %s\n",
"%sControlGroupModify: %s\n"
"%sPrivateNetwork: %s\n",
prefix, c->umask,
prefix, c->working_directory ? c->working_directory : "/",
prefix, c->root_directory ? c->root_directory : "/",
prefix, yes_no(c->non_blocking),
prefix, yes_no(c->private_tmp),
prefix, yes_no(c->control_group_modify));
prefix, yes_no(c->control_group_modify),
prefix, yes_no(c->private_network));
STRV_FOREACH(e, c->environment)
fprintf(f, "%sEnvironment: %s\n", prefix, *e);

1
src/execute.h
View File

@ -159,6 +159,7 @@ struct ExecContext {
bool cpu_sched_reset_on_fork;
bool non_blocking;
bool private_tmp;
bool private_network;
bool control_group_modify;

3
src/exit-status.c
View File

@ -116,6 +116,9 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) {
case EXIT_PAM:
return "PAM";
case EXIT_NETWORK:
return "NETWORK";
}
}

3
src/exit-status.h
View File

@ -64,7 +64,8 @@ typedef enum ExitStatus {
EXIT_CONFIRM,
EXIT_STDERR,
EXIT_TCPWRAP,
EXIT_PAM
EXIT_PAM,
EXIT_NETWORK
} ExitStatus;

1
src/load-fragment-gperf.gperf.m4
View File

@ -68,6 +68,7 @@ $1.ReadWriteDirectories, config_parse_path_strv, 0,
$1.ReadOnlyDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.read_only_dirs)
$1.InaccessibleDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.inaccessible_dirs)
$1.PrivateTmp, config_parse_bool, 0, offsetof($1, exec_context.private_tmp)
$1.PrivateNetwork, config_parse_bool, 0, offsetof($1, exec_context.private_network)
$1.MountFlags, config_parse_exec_mount_flags, 0, offsetof($1, exec_context)
$1.TCPWrapName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.tcpwrap_name)
$1.PAMName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.pam_name)

22
src/nspawn.c
View File

@ -48,7 +48,7 @@
static char *arg_directory = NULL;
static char *arg_user = NULL;
static bool arg_no_net = false;
static bool arg_private_network = false;
static int help(void) {
@ -57,7 +57,7 @@ static int help(void) {
" -h --help Show this help\n"
" -D --directory=NAME Root directory for the container\n"
" -u --user=USER Run the command under specified user or uid\n"
" --no-net Disable network in container\n",
" --private-network Disable network in container\n",
program_invocation_short_name);
return 0;
@ -66,15 +66,15 @@ static int help(void) {
static int parse_argv(int argc, char *argv[]) {
enum {
ARG_NO_NET = 0x100
ARG_PRIVATE_NETWORK = 0x100
};
static const struct option options[] = {
{ "help", no_argument, NULL, 'h' },
{ "directory", required_argument, NULL, 'D' },
{ "user", required_argument, NULL, 'u' },
{ "no-net", no_argument, NULL, ARG_NO_NET },
{ NULL, 0, NULL, 0 }
{ "help", no_argument, NULL, 'h' },
{ "directory", required_argument, NULL, 'D' },
{ "user", required_argument, NULL, 'u' },
{ "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
{ NULL, 0, NULL, 0 }
};
int c;
@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) {
break;
case ARG_NO_NET:
arg_no_net = true;
case ARG_PRIVATE_NETWORK:
arg_private_network = true;
break;
case '?':
@ -710,7 +710,7 @@ int main(int argc, char *argv[]) {
sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) {
if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) {
log_error("clone() failed: %m");
goto finish;
}