[people/ms/pakfire.git] / src / libpakfire / jail.c

/*#############################################################################
#                                                                             #
# Pakfire - The IPFire package management system                              #
# Copyright (C) 2022 Pakfire development team                                 #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
#############################################################################*/

#include <errno.h>
#include <fcntl.h>
#include <linux/capability.h>
#include <linux/sched.h>
#include <sched.h>
#include <signal.h>
#include <stdlib.h>
#include <syscall.h>
#include <sys/capability.h>
#include <sys/epoll.h>
#include <sys/eventfd.h>
#include <sys/personality.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <sys/wait.h>

// libseccomp
#include <seccomp.h>

#include <pakfire/arch.h>
#include <pakfire/jail.h>
#include <pakfire/logging.h>
#include <pakfire/mount.h>
#include <pakfire/pakfire.h>
#include <pakfire/util.h>

#define BUFFER_SIZE      1024 * 64
#define ENVIRON_SIZE     128
#define EPOLL_MAX_EVENTS 2

// The default environment that will be set for every command
static const struct environ {
	const char* key;
	const char* val;
} ENV[] = {
	{ "LANG", "en_US.utf-8" },
	{ "TERM", "vt100" },
	{ NULL, NULL },
};

struct pakfire_jail {
	struct pakfire* pakfire;
	int nrefs;

	// Flags
	int flags;

	// Environment
	char* env[ENVIRON_SIZE];

	// Logging
	pakfire_jail_log_callback log_callback;
	void* log_data;
};

struct pakfire_log_buffer {
	char data[BUFFER_SIZE];
	size_t used;
};

struct pakfire_jail_exec {
	// PID (of the child)
	pid_t pid;

	// Process status (from waitpid)
	int status;

	// FD to notify the client that the parent has finished initialization
	int completed_fd;

	// Log pipes
	struct {
		int stdout[2];
		int stderr[2];
	} pipes;

	// Log buffers
	struct {
		struct pakfire_log_buffer stdout;
		struct pakfire_log_buffer stderr;
	} buffers;
};

static int clone3(struct clone_args* args, size_t size) {
	return syscall(__NR_clone3, args, size);
}

static void pakfire_jail_free(struct pakfire_jail* jail) {
	DEBUG(jail->pakfire, "Freeing jail at %p\n", jail);

	// Free environment
	for (unsigned int i = 0; jail->env[i]; i++)
		free(jail->env[i]);

	pakfire_unref(jail->pakfire);
	free(jail);
}

static int pakfire_jail_default_log_callback(struct pakfire* pakfire, void* data,
		int priority, const char* line, size_t length) {
	switch (priority) {
		case LOG_INFO:
			INFO(pakfire, "%s", line);
			break;

		case LOG_ERR:
			ERROR(pakfire, "%s", line);
			break;
	}

	return 0;
}

static int pakfire_jail_setup_interactive_env(struct pakfire_jail* jail) {
	// Set PS1
	int r = pakfire_jail_set_env(jail, "PS1", "pakfire-jail \\w> ");
	if (r)
		return r;

	// Copy TERM
	char* TERM = secure_getenv("TERM");
	if (TERM) {
		r = pakfire_jail_set_env(jail, "TERM", TERM);
		if (r)
			return r;
	}

	// Copy LANG
	char* LANG = secure_getenv("LANG");
	if (LANG) {
		r = pakfire_jail_set_env(jail, "LANG", LANG);
		if (r)
			return r;
	}

	return 0;
}

int pakfire_jail_create(struct pakfire_jail** jail, struct pakfire* pakfire, int flags) {
	int r;

	// Allocate a new jail
	struct pakfire_jail* j = calloc(1, sizeof(*j));
	if (!j)
		return 1;

	// Reference Pakfire
	j->pakfire = pakfire_ref(pakfire);

	// Initialize reference counter
	j->nrefs = 1;

	// Store flags
	j->flags = flags;

	DEBUG(j->pakfire, "Allocated new jail at %p\n", j);

	// Set default log callback
	r = pakfire_jail_set_log_callback(j, pakfire_jail_default_log_callback, NULL);
	if (r)
		goto ERROR;

	// Set default environment
	for (const struct environ* e = ENV; e->key; e++) {
		r = pakfire_jail_set_env(j, e->key, e->val);
		if (r)
			goto ERROR;
	}

	// Setup interactive stuff
	if (j->flags & PAKFIRE_JAIL_INTERACTIVE) {
		r = pakfire_jail_setup_interactive_env(j);
		if (r)
			goto ERROR;
	}

	// Done
	*jail = j;
	return 0;

ERROR:
	pakfire_jail_free(j);

	return r;
}

struct pakfire_jail* pakfire_jail_ref(struct pakfire_jail* jail) {
	++jail->nrefs;

	return jail;
}

struct pakfire_jail* pakfire_jail_unref(struct pakfire_jail* jail) {
	if (--jail->nrefs > 0)
		return jail;

	pakfire_jail_free(jail);
	return NULL;
}

static int pakfire_jail_has_flag(struct pakfire_jail* jail, int flag) {
	return jail->flags & flag;
}

// Environment

// Returns the length of the environment
static unsigned int pakfire_jail_env_length(struct pakfire_jail* jail) {
	unsigned int i = 0;

	// Count everything in the environment
	for (char** e = jail->env; *e; e++)
		i++;

	return i;
}

// Finds an existing environment variable and returns its index or -1 if not found
static int pakfire_jail_find_env(struct pakfire_jail* jail, const char* key) {
	if (!key) {
		errno = EINVAL;
		return -1;
	}

	char buffer[strlen(key) + 2];
	pakfire_string_format(buffer, "%s=", key);

	for (unsigned int i = 0; jail->env[i]; i++) {
		if (pakfire_string_startswith(jail->env[i], buffer))
			return i;
	}

	// Nothing found
	return -1;
}

// Returns the value of an environment variable or NULL
const char* pakfire_jail_get_env(struct pakfire_jail* jail, const char* key) {
	int i = pakfire_jail_find_env(jail, key);
	if (i < 0)
		return NULL;

	return jail->env[i] + strlen(key) + 1;
}

// Sets an environment variable
int pakfire_jail_set_env(struct pakfire_jail* jail, const char* key, const char* value) {
	// Find the index where to write this value to
	int i = pakfire_jail_find_env(jail, key);
	if (i < 0)
		i = pakfire_jail_env_length(jail);

	// Return -ENOSPC when the environment is full
	if (i >= ENVIRON_SIZE) {
		errno = ENOSPC;
		return -1;
	}

	// Free any previous value
	if (jail->env[i])
		free(jail->env[i]);

	// Format and set environment variable
	asprintf(&jail->env[i], "%s=%s", key, value);

	DEBUG(jail->pakfire, "Set environment variable: %s\n", jail->env[i]);

	return 0;
}

// Imports an environment
int pakfire_jail_import_env(struct pakfire_jail* jail, const char* env[]) {
	if (!env)
		return 0;

	char* key;
	char* val;
	int r;

	// Copy environment variables
	for (unsigned int i = 0; env[i]; i++) {
		r = pakfire_string_partition(env[i], "=", &key, &val);
		if (r)
			continue;

		// Set value
		r = pakfire_jail_set_env(jail, key, val);

		if (key)
			free(key);
		if (val)
			free(val);

		// Break on error
		if (r)
			return r;
	}

	return 0;
}

// Logging

int pakfire_jail_set_log_callback(struct pakfire_jail* jail,
		pakfire_jail_log_callback callback, void* data) {
	jail->log_callback = callback;
	jail->log_data = data;

	return 0;
}

static int pakfire_jail_log_buffer_is_full(const struct pakfire_log_buffer* buffer) {
	return (sizeof(buffer->data) == buffer->used);
}

/*
	This function reads as much data as it can from the file descriptor.
	If it finds a whole line in it, it will send it to the logger and repeat the process.
	If not newline character is found, it will try to read more data until it finds one.
*/
static int pakfire_jail_handle_log(struct pakfire_jail* jail,
			struct pakfire_jail_exec* ctx, int priority, int fd, struct pakfire_log_buffer* buffer) {
	char line[BUFFER_SIZE + 1];

	// Fill up buffer from fd
	if (buffer->used < sizeof(buffer->data)) {
		ssize_t bytes_read = read(fd, buffer->data + buffer->used,
				sizeof(buffer->data) - buffer->used);

		// Handle errors
		if (bytes_read < 0) {
			ERROR(jail->pakfire, "Could not read from fd %d: %m\n", fd);
			return -1;
		}

		// Update buffer size
		buffer->used += bytes_read;
	}

	// See if we have any lines that we can write
	while (buffer->used) {
		// Search for the end of the first line
		char* eol = memchr(buffer->data, '\n', buffer->used);

		// No newline found
		if (!eol) {
			// If the buffer is full, we send the content to the logger and try again
			// This should not happen in practise
			if (pakfire_jail_log_buffer_is_full(buffer)) {
				DEBUG(jail->pakfire, "Logging buffer is full. Sending all content\n");

				eol = buffer->data + sizeof(buffer->data) - 1;

			// Otherwise we might have only read parts of the output
			} else
				break;
		}

		// Find the length of the string
		size_t length = eol - buffer->data + 1;

		// Copy the line into the buffer
		memcpy(line, buffer->data, length);

		// Terminate the string
		line[length] = '\0';

		// Log the line
		if (jail->log_callback) {
			int r = jail->log_callback(jail->pakfire, jail->log_data, priority, line, length);
			if (r) {
				ERROR(jail->pakfire, "The logging callback returned an error: %d\n", r);
				return r;
			}
		}

		// Remove line from buffer
		memmove(buffer->data, buffer->data + length, buffer->used - length);
		buffer->used -= length;
	}

	return 0;
}

static int pakfire_jail_logger(struct pakfire_jail* jail, struct pakfire_jail_exec* ctx) {
	int epollfd = -1;
	struct epoll_event ev;
	struct epoll_event events[EPOLL_MAX_EVENTS];
	int r = 0;

	// Fetch file descriptors from context
	const int stdout = ctx->pipes.stdout[1];
	const int stderr = ctx->pipes.stderr[1];

	int fds[2] = {
		stdout, stderr,
	};

	// Setup epoll
	epollfd = epoll_create1(0);
	if (epollfd < 0) {
		ERROR(jail->pakfire, "Could not initialize epoll(): %m\n");
		r = 1;
		goto OUT;
	}

	ev.events = EPOLLIN;

	// Turn file descriptors into non-blocking mode and add them to epoll()
	for (unsigned int i = 0; i < 2; i++) {
		int fd = fds[i];

		ev.data.fd = fd;

		if (epoll_ctl(epollfd, EPOLL_CTL_ADD, fd, &ev) < 0) {
			ERROR(jail->pakfire, "Could not add file descriptor %d to epoll(): %m\n", fd);
			r = 1;
			goto OUT;
		}
	}

	int ended = 0;

	// Loop for as long as the process is alive
	while (!ended) {
		// If waitpid() returns non-zero, the process has ended, but we want to perform
		// one last iteration over the loop to read any remaining content from the file
		// descriptor buffers.
		r = waitpid(ctx->pid, &ctx->status, WNOHANG);
		if (r)
			ended = 1;

		int num = epoll_wait(epollfd, events, EPOLL_MAX_EVENTS, -1);
		if (num < 1) {
			// Ignore if epoll_wait() has been interrupted
			if (errno == EINTR)
				continue;

			ERROR(jail->pakfire, "epoll_wait() failed: %m\n");
			r = 1;

			goto OUT;
		}

		struct pakfire_log_buffer* buffer;
		int priority;

		for (int i = 0; i < num; i++) {
			int fd = events[i].data.fd;

			if (fd == stdout) {
				buffer = &ctx->buffers.stdout;
				priority = LOG_INFO;

			} else if (fd == stderr) {
				buffer = &ctx->buffers.stderr;
				priority = LOG_ERR;

			} else {
				DEBUG(jail->pakfire, "Received invalid file descriptor %d\n", fd);
				continue;
			}

			// Handle log event
			r = pakfire_jail_handle_log(jail, ctx, priority, fd, buffer);
			if (r)
				goto OUT;
		}
	}

OUT:
	if (epollfd > 0)
		close(epollfd);

	return r;
}

static int pakfire_jail_capture_stdout(struct pakfire* pakfire, void* data, int priority,
		const char* line, size_t length) {
	char*** array = (char***)data;

	// Append everything from stdout to an array
	if (priority == LOG_INFO) {
		length = 0;

		// Create a copy of line
		char* message = strdup(line);
		if (!message)
			return 1;

		// Remove any trailing newline
		pakfire_remove_trailing_newline(message);

		// Determine the length of the existing array
		if (*array) {
			for (char** element = *array; *element; element++)
				length++;
		}

		// Allocate space
		*array = reallocarray(*array, length + 2, sizeof(**array));
		if (!*array)
			return 1;

		// Append message and terminate the array
		(*array)[length] = message;
		(*array)[length + 1] = NULL;

		return 0;
	}

	// Send everything else to the default logger
	return pakfire_jail_default_log_callback(pakfire, NULL, priority, line, length);
}

// Capabilities

static int pakfire_jail_drop_capabilities(struct pakfire_jail* jail) {
	const int capabilities[] = {
		// Deny access to the kernel's audit system
		CAP_AUDIT_CONTROL,
		CAP_AUDIT_READ,
		CAP_AUDIT_WRITE,

		// Deny suspending block devices
		CAP_BLOCK_SUSPEND,

		// Deny any stuff with BPF
		CAP_BPF,

		// Deny checkpoint restore
		CAP_CHECKPOINT_RESTORE,

		// Deny opening files by inode number (open_by_handle_at)
		CAP_DAC_READ_SEARCH,

		// Deny setting SUID bits
		CAP_FSETID,

		// Deny locking more memory
		CAP_IPC_LOCK,

		// Deny modifying any Apparmor/SELinux/SMACK configuration
		CAP_MAC_ADMIN,
		CAP_MAC_OVERRIDE,

		// Deny creating any special devices
		CAP_MKNOD,

		// Deny setting any capabilities
		CAP_SETFCAP,

		// Deny reading from syslog
		CAP_SYSLOG,

		// Deny any admin actions (mount, sethostname, ...)
		CAP_SYS_ADMIN,

		// Deny rebooting the system
		CAP_SYS_BOOT,

		// Deny loading kernel modules
		CAP_SYS_MODULE,

		// Deny setting nice level
		CAP_SYS_NICE,

		// Deny access to /proc/kcore, /dev/mem, /dev/kmem
		CAP_SYS_RAWIO,

		// Deny circumventing any resource limits
		CAP_SYS_RESOURCE,

		// Deny setting the system time
		CAP_SYS_TIME,

		// Deny playing with suspend
		CAP_WAKE_ALARM,

		0,
	};

	DEBUG(jail->pakfire, "Dropping capabilities...\n");

	size_t num_caps = 0;
	int r;

	// Drop any capabilities
	for (const int* cap = capabilities; *cap; cap++) {
		r = prctl(PR_CAPBSET_DROP, *cap, 0, 0, 0);
		if (r) {
			ERROR(jail->pakfire, "Could not drop capability %d: %m\n", *cap);
			return r;
		}

		num_caps++;
	}

	// Fetch any capabilities
	cap_t caps = cap_get_proc();
	if (!caps) {
		ERROR(jail->pakfire, "Could not read capabilities: %m\n");
		return 1;
	}

	/*
		Set inheritable capabilities

		This ensures that no processes will be able to gain any of the listed
		capabilities again.
	*/
	r = cap_set_flag(caps, CAP_INHERITABLE, num_caps, capabilities, CAP_CLEAR);
	if (r) {
		ERROR(jail->pakfire, "cap_set_flag() failed: %m\n");
		goto ERROR;
	}

	// Restore capabilities
	r = cap_set_proc(caps);
	if (r) {
		ERROR(jail->pakfire, "Could not restore capabilities: %m\n");
		goto ERROR;
	}

ERROR:
	if (caps)
		cap_free(caps);

	return r;
}

// Syscall Filter

static int pakfire_jail_limit_syscalls(struct pakfire_jail* jail) {
	const int syscalls[] = {
		// The kernel's keyring isn't namespaced
		SCMP_SYS(keyctl),
		SCMP_SYS(add_key),
		SCMP_SYS(request_key),

		// Disable userfaultfd
		SCMP_SYS(userfaultfd),

		// Disable perf which could leak a lot of information about the host
		SCMP_SYS(perf_event_open),

		0,
	};
	int r = 1;

	DEBUG(jail->pakfire, "Applying syscall filter...\n");

	// Setup a syscall filter which allows everything by default
	scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);
	if (!ctx) {
		ERROR(jail->pakfire, "Could not setup seccomp filter: %m\n");
		goto ERROR;
	}

	// All all syscalls
	for (const int* syscall = syscalls; *syscall; syscall++) {
		r = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), *syscall, 0);
		if (r) {
			ERROR(jail->pakfire, "Could not configure syscall %d: %m\n", *syscall);
			goto ERROR;
		}
	}

	// Load syscall filter into the kernel
	r = seccomp_load(ctx);
	if (r) {
		ERROR(jail->pakfire, "Could not load syscall filter into the kernel: %m\n");
		goto ERROR;
	}

ERROR:
	if (ctx)
		seccomp_release(ctx);

	return r;
}

// UID/GID Mapping

static int pakfire_jail_write_uidgid_mapping(struct pakfire_jail* jail,
		const char* path, uid_t mapped_id, size_t length) {
	int r = 1;

	// Open file for writing
	FILE* f = fopen(path, "w");
	if (!f) {
		ERROR(jail->pakfire, "Could not open %s for writing: %m\n", path);
		goto ERROR;
	}

	// Write configuration
	int bytes_written = fprintf(f, "%d %d %ld\n", 0, mapped_id, length);
	if (bytes_written <= 0) {
		ERROR(jail->pakfire, "Could not write UID/GID mapping: %m\n");
		goto ERROR;
	}

	// Close the file
	r = fclose(f);
	f = NULL;
	if (r) {
		ERROR(jail->pakfire, "Could not write UID/GID mapping: %m\n");

		goto ERROR;
	}

	// Success
	r = 0;

ERROR:
	if (f)
		fclose(f);

	return r;
}

static int pakfire_jail_setup_uid_mapping(struct pakfire_jail* jail, pid_t pid) {
	char path[PATH_MAX];
	int r;

	uid_t mapped_uid = 0;
	const size_t length = 1;

	// Fetch the UID of the calling process
	uid_t uid = getuid();

	// Have we been called by root?
	if (uid == 0) {
		mapped_uid = 0;

	// Have we been called by an unprivileged user?
	} else {
		// XXX fetch SUBUID
		mapped_uid = uid;
	}

	// Make path
	r = pakfire_string_format(path, "/proc/%d/uid_map", pid);
	if (r < 0)
		return 1;

	DEBUG(jail->pakfire, "Mapping UID range (%u - %lu)\n", mapped_uid, mapped_uid + length);

	return pakfire_jail_write_uidgid_mapping(jail, path, mapped_uid, length);
}

static int pakfire_jail_setup_gid_mapping(struct pakfire_jail* jail, pid_t pid) {
	char path[PATH_MAX];
	int r;

	gid_t mapped_gid = 0;
	const size_t length = 1;

	// Fetch the GID of the calling process
	gid_t gid = getgid();

	// Have we been called from the root group?
	if (gid == 0) {
		mapped_gid = 0;

	// Have we been called by an unprivileged group?
	} else {
		// XXX fetch SUBGID
		mapped_gid = gid;
	}

	// Make path
	r = pakfire_string_format(path, "/proc/%d/gid_map", pid);
	if (r < 0)
		return 1;

	DEBUG(jail->pakfire, "Mapping GID range (%u - %lu)\n", mapped_gid, mapped_gid + length);

	return pakfire_jail_write_uidgid_mapping(jail, path, mapped_gid, length);
}

static int pakfire_jail_setgroups(struct pakfire_jail* jail, pid_t pid) {
	char path[PATH_MAX];
	int r = 1;

	// Make path
	r = pakfire_string_format(path, "/proc/%d/setgroups", pid);
	if (r < 0)
		return 1;

	// Open file for writing
	FILE* f = fopen(path, "w");
	if (!f) {
		ERROR(jail->pakfire, "Could not open %s for writing: %m\n", path);
		goto ERROR;
	}

	// Write content
	int bytes_written = fprintf(f, "deny\n");
	if (bytes_written <= 0) {
		ERROR(jail->pakfire, "Could not write to %s: %m\n", path);
		goto ERROR;
	}

	r = fclose(f);
	f = NULL;
	if (r) {
		ERROR(jail->pakfire, "Could not close %s: %m\n", path);
		goto ERROR;
	}

ERROR:
	if (f)
		fclose(f);

	return r;
}

static int pakfire_jail_send_signal(struct pakfire_jail* jail, int fd) {
	const uint64_t val = 1;
	int r = 0;

	DEBUG(jail->pakfire, "Sending signal...\n");

	// Write to the file descriptor
	ssize_t bytes_written = write(fd, &val, sizeof(val));
	if (bytes_written < 0 || (size_t)bytes_written < sizeof(val)) {
		ERROR(jail->pakfire, "Could not send signal: %m\n");
		r = 1;
	}

	// Close the file descriptor
	close(fd);

	return r;
}

static int pakfire_jail_wait_for_signal(struct pakfire_jail* jail, int fd) {
	uint64_t val = 0;
	int r = 0;

	DEBUG(jail->pakfire, "Waiting for signal...\n");

	ssize_t bytes_read = read(fd, &val, sizeof(val));
	if (bytes_read < 0 || (size_t)bytes_read < sizeof(val)) {
		ERROR(jail->pakfire, "Error waiting for signal: %m\n");
		r = 1;
	}

	// Close the file descriptor
	close(fd);

	return r;
}

/*
	Performs the initialisation that needs to happen in the parent part
*/
static int pakfire_jail_parent(struct pakfire_jail* jail, struct pakfire_jail_exec* ctx) {
	int r;

	// Setup UID mapping
	r = pakfire_jail_setup_uid_mapping(jail, ctx->pid);
	if (r)
		return r;

	// Write "deny" to /proc/PID/setgroups
	r = pakfire_jail_setgroups(jail, ctx->pid);
	if (r)
		return r;

	// Setup GID mapping
	r = pakfire_jail_setup_gid_mapping(jail, ctx->pid);
	if (r)
		return r;

	// Parent has finished initialisation
	DEBUG(jail->pakfire, "Parent has finished initialization\n");

	// Send signal to client
	r = pakfire_jail_send_signal(jail, ctx->completed_fd);
	if (r)
		return r;

	return 0;
}

static int pakfire_jail_child(struct pakfire_jail* jail, struct pakfire_jail_exec* ctx,
		const char* argv[]) {
	int r;

	// XXX do we have to reconfigure logging here?

	DEBUG(jail->pakfire, "Launched child process in jail with PID %d\n", getpid());

	// Wait for the parent to finish initialization
	r = pakfire_jail_wait_for_signal(jail, ctx->completed_fd);
	if (r)
		return r;

	// Perform further initialization

	// Fetch UID/GID
	uid_t uid = getuid();
	gid_t gid = getgid();

	// Fetch EUID/EGID
	uid_t euid = geteuid();
	gid_t egid = getegid();

	DEBUG(jail->pakfire, "  UID: %d (effective %d)\n", uid, euid);
	DEBUG(jail->pakfire, "  GID: %d (effective %d)\n", gid, egid);

	// Check if we are (effectively running as root)
	if (uid != 0 || gid != 0) {
		ERROR(jail->pakfire, "Child process is not running as root\n");
		return 126;
	}

	const char* root = pakfire_get_path(jail->pakfire);
	const char* arch = pakfire_get_arch(jail->pakfire);

	// Change root (unless root is /)
	if (!pakfire_on_root(jail->pakfire)) {
		// Mount everything
		r = pakfire_mount_all(jail->pakfire);
		if (r)
			return r;

		// Log all mountpoints
		pakfire_mount_list(jail->pakfire);

		// Call chroot()
		r = chroot(root);
		if (r) {
			ERROR(jail->pakfire, "chroot() to %s failed: %m\n", root);
			return 1;
		}

		// Change directory to /
		r = chdir("/");
		if (r) {
			ERROR(jail->pakfire, "chdir() after chroot() failed: %m\n");
			return 1;
		}
	}

	// Set personality
	unsigned long persona = pakfire_arch_personality(arch);
	if (persona) {
		r = personality(persona);
		if (r < 0) {
			ERROR(jail->pakfire, "Could not set personality (%x)\n", (unsigned int)persona);
			return 1;
		}
	}

	// Reset open file limit (http://0pointer.net/blog/file-descriptor-limits.html)
	r = pakfire_rlimit_reset_nofile(jail->pakfire);
	if (r)
		return r;

	// Drop capabilities
	r = pakfire_jail_drop_capabilities(jail);
	if (r)
		return r;

	// Filter syscalls
	r = pakfire_jail_limit_syscalls(jail);
	if (r)
		return r;

	// exec() command
	r = execvpe(argv[0], (char**)argv, jail->env);
	if (r < 0)
		ERROR(jail->pakfire, "Could not execve(): %m\n");

	// Translate errno into regular exit code
	switch (errno) {
		case ENOENT:
			r = 127;
			break;

		default:
			r = 1;
	}

	// We should not get here
	return r;
}

// Run a command in the jail
static int __pakfire_jail_exec(struct pakfire_jail* jail, const char* argv[]) {
	int exit = -1;
	int r;

	// Check if argv is valid
	if (!argv || !argv[0]) {
		errno = EINVAL;
		return -1;
	}

	// Initialize context for this call
	struct pakfire_jail_exec ctx = {
		.pipes = {
			.stdout = { 0, 0, },
			.stderr = { 0, 0, },
		},
		.status = 0,
	};

	DEBUG(jail->pakfire, "Executing jail...\n");

	/*
		Setup a file descriptor which can be used to notify the client that the parent
		has completed configuration.
	*/
	ctx.completed_fd = eventfd(0, EFD_CLOEXEC);
	if (ctx.completed_fd < 0) {
		ERROR(jail->pakfire, "eventfd() failed: %m\n");
		return -1;
	}

	// Create pipes to communicate with child process if we are not running interactively
	if (!pakfire_jail_has_flag(jail, PAKFIRE_JAIL_INTERACTIVE)) {
		// stdout
		r = pipe2(ctx.pipes.stdout, O_NONBLOCK);
		if (r < 0) {
			ERROR(jail->pakfire, "Could not create file descriptors for stdout: %m\n");
			goto ERROR;
		}

		// stderr
		r = pipe2(ctx.pipes.stderr, O_NONBLOCK);
		if (r < 0) {
			ERROR(jail->pakfire, "Could not create file descriptors for stderr: %m\n");
			goto ERROR;
		}
	}

	// Configure child process
	struct clone_args args = {
		.flags =
			CLONE_NEWCGROUP |
			CLONE_NEWIPC |
			CLONE_NEWNS |
			CLONE_NEWPID |
			CLONE_NEWUSER |
			CLONE_NEWUTS,
		.exit_signal = SIGCHLD,
	};

	// Fork this process
	ctx.pid = clone3(&args, sizeof(args));
	if (ctx.pid < 0) {
		ERROR(jail->pakfire, "Could not clone: %m\n");
		return -1;

	// Child process
	} else if (ctx.pid == 0) {
		r = pakfire_jail_child(jail, &ctx, argv);
		_exit(r);
	}

	// Parent process
	r = pakfire_jail_parent(jail, &ctx);
	if (r)
		goto ERROR;

	DEBUG(jail->pakfire, "Waiting for PID %d to finish its work\n", ctx.pid);

	// Read output of the child process
	if (!pakfire_jail_has_flag(jail, PAKFIRE_JAIL_INTERACTIVE)) {
		r = pakfire_jail_logger(jail, &ctx);
		if (r)
			ERROR(jail->pakfire, "Log reading aborted: %m\n");
	}

	if (!ctx.status)
		waitpid(ctx.pid, &ctx.status, 0);

	if (WIFEXITED(ctx.status)) {
		exit = WEXITSTATUS(ctx.status);

		DEBUG(jail->pakfire, "Child process exited with code: %d\n", exit);
	} else {
		ERROR(jail->pakfire, "Could not determine the exit status of process %d\n", ctx.pid);

		errno = ESRCH;
		exit = -1;
	}

ERROR:
	// Close any file descriptors
	if (ctx.pipes.stdout[0])
		close(ctx.pipes.stdout[0]);
	if (ctx.pipes.stdout[1])
		close(ctx.pipes.stdout[1]);
	if (ctx.pipes.stderr[0])
		close(ctx.pipes.stderr[0]);
	if (ctx.pipes.stderr[1])
		close(ctx.pipes.stderr[1]);

	// Umount everything
	if (!pakfire_on_root(jail->pakfire))
		pakfire_umount_all(jail->pakfire);

	return exit;
}

int pakfire_jail_exec(struct pakfire_jail* jail, const char* argv[], char*** output) {
	int r;

	// Store logging callback
	pakfire_jail_log_callback log_callback = jail->log_callback;
	void* log_data = jail->log_data;

	// Capture output if requested by user
	if (output)
		pakfire_jail_set_log_callback(jail, pakfire_jail_capture_stdout, output);

	// Run exec()
	r = __pakfire_jail_exec(jail, argv);

	// Restore log callback
	pakfire_jail_set_log_callback(jail, log_callback, log_data);

	return r;
}

int pakfire_jail_exec_script(struct pakfire_jail* jail,
		const char* script, const size_t size, const char* args[], char*** output) {
	char path[PATH_MAX];
	const char** argv = NULL;
	int r;

	const char* root = pakfire_get_path(jail->pakfire);

	// Write the scriptlet to disk
	r = pakfire_path_join(path, root, "pakfire-script.XXXXXX");
	if (r < 0)
		goto ERROR;

	// Open a temporary file
	int fd = mkstemp(path);
	if (fd < 0) {
		ERROR(jail->pakfire, "Could not open a temporary file: %m\n");
		r = 1;
		goto ERROR;
	}

	DEBUG(jail->pakfire, "Writing script to %s:\n%.*s\n", path, (int)size, script);

	// Write data
	ssize_t bytes_written = write(fd, script, size);
	if (bytes_written < (ssize_t)size) {
		ERROR(jail->pakfire, "Could not write script to file %s: %m\n", path);
		r = 1;
		goto ERROR;
	}

	// Make the script executable
	r = fchmod(fd, S_IRUSR|S_IWUSR|S_IXUSR);
	if (r) {
		ERROR(jail->pakfire, "Could not set executable permissions on %s: %m\n", path);
		goto ERROR;
	}

	// Close file
	r = close(fd);
	if (r) {
		ERROR(jail->pakfire, "Could not close script file %s: %m\n", path);
		r = 1;
		goto ERROR;
	}

	// Count how many arguments were passed
	unsigned int argc = 1;
	if (args) {
		for (const char** arg = args; *arg; arg++)
			argc++;
	}

	argv = calloc(argc + 1, sizeof(*argv));
	if (!argv) {
		ERROR(jail->pakfire, "Could not allocate argv: %m\n");
		goto ERROR;
	}

	// Set command
	argv[0] = (root) ? pakfire_path_relpath(root, path) : path;

	// Copy args
	for (unsigned int i = 1; i < argc; i++)
		argv[i] = args[i-1];

	// Run the script
	r = pakfire_jail_exec(jail, argv, output);

ERROR:
	if (argv)
		free(argv);

	// Remove script from disk
	if (*path)
		unlink(path);

	return r;
}

/*
	A convenience function that creates a new jail, runs the given command and destroys
	the jail again.
*/
int pakfire_jail_run(struct pakfire* pakfire, const char* argv[], int flags, char*** output) {
	struct pakfire_jail* jail = NULL;
	int r;

	// Create a new jail
	r = pakfire_jail_create(&jail, pakfire, flags);
	if (r)
		goto ERROR;

	// Execute the command
	r = pakfire_jail_exec(jail, argv, output);

ERROR:
	if (jail)
		pakfire_jail_unref(jail);

	return r;
}

int pakfire_jail_run_script(struct pakfire* pakfire,
		const char* script, const size_t length, const char* argv[], int flags, char*** output) {
	struct pakfire_jail* jail = NULL;
	int r;

	// Create a new jail
	r = pakfire_jail_create(&jail, pakfire, flags);
	if (r)
		goto ERROR;

	// Execute the command
	r = pakfire_jail_exec_script(jail, script, length, argv, output);

ERROR:
	if (jail)
		pakfire_jail_unref(jail);

	return r;
}


int pakfire_jail_shell(struct pakfire* pakfire) {
	const char* argv[] = {
		"/bin/bash", "--login", NULL,
	};

	// Execute /bin/bash
	return pakfire_jail_run(pakfire, argv, PAKFIRE_JAIL_INTERACTIVE, NULL);
}

int pakfire_jail_ldconfig(struct pakfire* pakfire) {
	char path[PATH_MAX];

	const char* ldconfig = "/sbin/ldconfig";

	// Check if ldconfig exists before calling it to avoid overhead
	int r = pakfire_make_path(pakfire, path, ldconfig);
	if (r < 0)
		return 1;

	// Check if ldconfig is executable
	r = access(path, X_OK);
	if (r) {
		DEBUG(pakfire, "%s is not executable. Skipping...\n", ldconfig);
		return 0;
	}

	const char* argv[] = {
		ldconfig, NULL,
	};

	// Run ldconfig
	return pakfire_jail_run(pakfire, argv, 0, NULL);
}