picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

exec: introduce PrivateNetwork= process option to turn off network access to specific services

This commit is contained in:
Lennart Poettering 2011-08-02 05:24:58 +02:00
parent 4f755fc6ab
commit ff01d048b4
10 changed files with 59 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
TODO
View File

@ -19,6 +19,8 @@ Bugfixes:
Features: Features:
* hide PAM/TCPWrap options in fragment parser when compile time disabled
* make arbitrary cgroups attributes settable * make arbitrary cgroups attributes settable
* when we automatically restart a service, ensure we retsart its rdeps, too. * when we automatically restart a service, ensure we retsart its rdeps, too.

2
man/systemd-nspawn.xml
View File

@ -155,7 +155,7 @@
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><option>--no-net</option></term> <term><option>--private-network</option></term>
<listitem><para>Turn off networking in <listitem><para>Turn off networking in
the container. This makes all network the container. This makes all network

26
man/systemd.exec.xml
View File

@ -783,9 +783,9 @@
<term><varname>PrivateTmp=</varname></term> <term><varname>PrivateTmp=</varname></term>
<listitem><para>Takes a boolean <listitem><para>Takes a boolean
argument. If true sets up a new argument. If true sets up a new file
namespace for the executed processes system namespace for the executed
and mounts a private processes and mounts a private
<filename>/tmp</filename> directory <filename>/tmp</filename> directory
inside it, that is not shared by inside it, that is not shared by
processes outside of the processes outside of the
@ -794,7 +794,25 @@
process, but makes sharing between process, but makes sharing between
processes via processes via
<filename>/tmp</filename> <filename>/tmp</filename>
impossible. Defaults to false.</para></listitem> impossible. Defaults to
false.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>PrivateNetwork=</varname></term>
<listitem><para>Takes a boolean
argument. If true sets up a new
network namespace for the executed
processes and configures only the
loopback network device
<literal>lo</literal> inside it. No
other network devices will be
available to the executed process.
This is useful to securely turn off
network access by the executed
process. Defaults to
false.</para></listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>

4
src/dbus-execute.h
View File

@ -92,7 +92,8 @@
" <property name=\"KillMode\" type=\"s\" access=\"read\"/>\n" \ " <property name=\"KillMode\" type=\"s\" access=\"read\"/>\n" \
" <property name=\"KillSignal\" type=\"i\" access=\"read\"/>\n" \ " <property name=\"KillSignal\" type=\"i\" access=\"read\"/>\n" \
" <property name=\"UtmpIdentifier\" type=\"s\" access=\"read\"/>\n" \ " <property name=\"UtmpIdentifier\" type=\"s\" access=\"read\"/>\n" \
" <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" " <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" \
" <property name=\"PrivateNetwork\" type=\"b\" access=\"read\"/>\n"
#define BUS_EXEC_COMMAND_INTERFACE(name) \ #define BUS_EXEC_COMMAND_INTERFACE(name) \
" <property name=\"" name "\" type=\"a(sasbttuii)\" access=\"read\"/>\n" " <property name=\"" name "\" type=\"a(sasbttuii)\" access=\"read\"/>\n"
@ -151,6 +152,7 @@
{ interface, "InaccessibleDirectories", bus_property_append_strv, "as", (context).inaccessible_dirs }, \ { interface, "InaccessibleDirectories", bus_property_append_strv, "as", (context).inaccessible_dirs }, \
{ interface, "MountFlags", bus_property_append_ul, "t", &(context).mount_flags }, \ { interface, "MountFlags", bus_property_append_ul, "t", &(context).mount_flags }, \
{ interface, "PrivateTmp", bus_property_append_bool, "b", &(context).private_tmp }, \ { interface, "PrivateTmp", bus_property_append_bool, "b", &(context).private_tmp }, \
{ interface, "PrivateNetwork", bus_property_append_bool, "b", &(context).private_network }, \
{ interface, "SameProcessGroup", bus_property_append_bool, "b", &(context).same_pgrp }, \ { interface, "SameProcessGroup", bus_property_append_bool, "b", &(context).same_pgrp }, \
{ interface, "KillMode", bus_execute_append_kill_mode, "s", &(context).kill_mode }, \ { interface, "KillMode", bus_execute_append_kill_mode, "s", &(context).kill_mode }, \
{ interface, "KillSignal", bus_property_append_int, "i", &(context).kill_signal }, \ { interface, "KillSignal", bus_property_append_int, "i", &(context).kill_signal }, \

15
src/execute.c
View File

@ -56,6 +56,7 @@
#include "missing.h" #include "missing.h"
#include "utmp-wtmp.h" #include "utmp-wtmp.h"
#include "def.h" #include "def.h"
#include "loopback-setup.h"
/* This assumes there is a 'tty' group */ /* This assumes there is a 'tty' group */
#define TTY_MODE 0620 #define TTY_MODE 0620
@ -1208,6 +1209,14 @@ int exec_spawn(ExecCommand *command,
} }
} }
#endif #endif
if (context->private_network) {
if (unshare(CLONE_NEWNET) < 0) {
r = EXIT_NETWORK;
goto fail_child;
}
loopback_setup();
}
if (strv_length(context->read_write_dirs) > 0 || if (strv_length(context->read_write_dirs) > 0 ||
strv_length(context->read_only_dirs) > 0 || strv_length(context->read_only_dirs) > 0 ||
@ -1594,13 +1603,15 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
"%sRootDirectory: %s\n" "%sRootDirectory: %s\n"
"%sNonBlocking: %s\n" "%sNonBlocking: %s\n"
"%sPrivateTmp: %s\n" "%sPrivateTmp: %s\n"
"%sControlGroupModify: %s\n", "%sControlGroupModify: %s\n"
"%sPrivateNetwork: %s\n",
prefix, c->umask, prefix, c->umask,
prefix, c->working_directory ? c->working_directory : "/", prefix, c->working_directory ? c->working_directory : "/",
prefix, c->root_directory ? c->root_directory : "/", prefix, c->root_directory ? c->root_directory : "/",
prefix, yes_no(c->non_blocking), prefix, yes_no(c->non_blocking),
prefix, yes_no(c->private_tmp), prefix, yes_no(c->private_tmp),
prefix, yes_no(c->control_group_modify)); prefix, yes_no(c->control_group_modify),
prefix, yes_no(c->private_network));
STRV_FOREACH(e, c->environment) STRV_FOREACH(e, c->environment)
fprintf(f, "%sEnvironment: %s\n", prefix, *e); fprintf(f, "%sEnvironment: %s\n", prefix, *e);

1
src/execute.h
View File

@ -159,6 +159,7 @@ struct ExecContext {
bool cpu_sched_reset_on_fork; bool cpu_sched_reset_on_fork;
bool non_blocking; bool non_blocking;
bool private_tmp; bool private_tmp;
bool private_network;
bool control_group_modify; bool control_group_modify;

3
src/exit-status.c
View File

@ -116,6 +116,9 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) {
case EXIT_PAM: case EXIT_PAM:
return "PAM"; return "PAM";
case EXIT_NETWORK:
return "NETWORK";
} }
} }

3
src/exit-status.h
View File

@ -64,7 +64,8 @@ typedef enum ExitStatus {
EXIT_CONFIRM, EXIT_CONFIRM,
EXIT_STDERR, EXIT_STDERR,
EXIT_TCPWRAP, EXIT_TCPWRAP,
EXIT_PAM EXIT_PAM,
EXIT_NETWORK
} ExitStatus; } ExitStatus;

1
src/load-fragment-gperf.gperf.m4
View File

@ -68,6 +68,7 @@ $1.ReadWriteDirectories, config_parse_path_strv, 0,
$1.ReadOnlyDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.read_only_dirs) $1.ReadOnlyDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.read_only_dirs)
$1.InaccessibleDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.inaccessible_dirs) $1.InaccessibleDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.inaccessible_dirs)
$1.PrivateTmp, config_parse_bool, 0, offsetof($1, exec_context.private_tmp) $1.PrivateTmp, config_parse_bool, 0, offsetof($1, exec_context.private_tmp)
$1.PrivateNetwork, config_parse_bool, 0, offsetof($1, exec_context.private_network)
$1.MountFlags, config_parse_exec_mount_flags, 0, offsetof($1, exec_context) $1.MountFlags, config_parse_exec_mount_flags, 0, offsetof($1, exec_context)
$1.TCPWrapName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.tcpwrap_name) $1.TCPWrapName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.tcpwrap_name)
$1.PAMName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.pam_name) $1.PAMName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.pam_name)

22
src/nspawn.c
View File

@ -48,7 +48,7 @@
static char *arg_directory = NULL; static char *arg_directory = NULL;
static char *arg_user = NULL; static char *arg_user = NULL;
static bool arg_no_net = false; static bool arg_private_network = false;
static int help(void) { static int help(void) {
@ -57,7 +57,7 @@ static int help(void) {
" -h --help Show this help\n" " -h --help Show this help\n"
" -D --directory=NAME Root directory for the container\n" " -D --directory=NAME Root directory for the container\n"
" -u --user=USER Run the command under specified user or uid\n" " -u --user=USER Run the command under specified user or uid\n"
" --no-net Disable network in container\n", " --private-network Disable network in container\n",
program_invocation_short_name); program_invocation_short_name);
return 0; return 0;
@ -66,15 +66,15 @@ static int help(void) {
static int parse_argv(int argc, char *argv[]) { static int parse_argv(int argc, char *argv[]) {
enum { enum {
ARG_NO_NET = 0x100 ARG_PRIVATE_NETWORK = 0x100
}; };
static const struct option options[] = { static const struct option options[] = {
{ "help", no_argument, NULL, 'h' }, { "help", no_argument, NULL, 'h' },
{ "directory", required_argument, NULL, 'D' }, { "directory", required_argument, NULL, 'D' },
{ "user", required_argument, NULL, 'u' }, { "user", required_argument, NULL, 'u' },
{ "no-net", no_argument, NULL, ARG_NO_NET }, { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
{ NULL, 0, NULL, 0 } { NULL, 0, NULL, 0 }
}; };
int c; int c;
@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) {
break; break;
case ARG_NO_NET: case ARG_PRIVATE_NETWORK:
arg_no_net = true; arg_private_network = true;
break; break;
case '?': case '?':
@ -710,7 +710,7 @@ int main(int argc, char *argv[]) {
sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1); sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0); assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) { if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) {
log_error("clone() failed: %m"); log_error("clone() failed: %m");
goto finish; goto finish;
} }