src/nspawn/nspawn-bind-user.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include "fd-util.h"
   4 #include "fileio.h"
   5 #include "format-util.h"
   6 #include "fs-util.h"
   7 #include "nspawn-bind-user.h"
   8 #include "nspawn.h"
   9 #include "path-util.h"
  10 #include "user-util.h"
  11 #include "userdb.h"
  12
  13 #define MAP_UID_START 60514
  14 #define MAP_UID_END 60577
  15
  16 static int check_etc_passwd_collisions(
  17                 const char *directory,
  18                 const char *name,
  19                 uid_t uid) {
  20
  21         _cleanup_fclose_ FILE *f = NULL;
  22         int r;
  23
  24         assert(directory);
  25         assert(name || uid_is_valid(uid));
  26
  27         r = chase_symlinks_and_fopen_unlocked("/etc/passwd", directory, CHASE_PREFIX_ROOT, "re", &f, NULL);
  28         if (r == -ENOENT)
  29                 return 0; /* no user database? then no user, hence no collision */
  30         if (r < 0)
  31                 return log_error_errno(r, "Failed to open /etc/passwd of container: %m");
  32
  33         for (;;) {
  34                 struct passwd *pw;
  35
  36                 r = fgetpwent_sane(f, &pw);
  37                 if (r < 0)
  38                         return log_error_errno(r, "Failed to iterate through /etc/passwd of container: %m");
  39                 if (r == 0) /* EOF */
  40                         return 0; /* no collision */
  41
  42                 if (name && streq_ptr(pw->pw_name, name))
  43                         return 1; /* name collision */
  44                 if (uid_is_valid(uid) && pw->pw_uid == uid)
  45                         return 1; /* UID collision */
  46         }
  47 }
  48
  49 static int check_etc_group_collisions(
  50                 const char *directory,
  51                 const char *name,
  52                 gid_t gid) {
  53
  54         _cleanup_fclose_ FILE *f = NULL;
  55         int r;
  56
  57         assert(directory);
  58         assert(name || gid_is_valid(gid));
  59
  60         r = chase_symlinks_and_fopen_unlocked("/etc/group", directory, CHASE_PREFIX_ROOT, "re", &f, NULL);
  61         if (r == -ENOENT)
  62                 return 0; /* no group database? then no group, hence no collision */
  63         if (r < 0)
  64                 return log_error_errno(r, "Failed to open /etc/group of container: %m");
  65
  66         for (;;) {
  67                 struct group *gr;
  68
  69                 r = fgetgrent_sane(f, &gr);
  70                 if (r < 0)
  71                         return log_error_errno(r, "Failed to iterate through /etc/group of container: %m");
  72                 if (r == 0)
  73                         return 0; /* no collision */
  74
  75                 if (name && streq_ptr(gr->gr_name, name))
  76                         return 1; /* name collision */
  77                 if (gid_is_valid(gid) && gr->gr_gid == gid)
  78                         return 1; /* gid collision */
  79         }
  80 }
  81
  82 static int convert_user(
  83                 const char *directory,
  84                 UserRecord *u,
  85                 GroupRecord *g,
  86                 uid_t allocate_uid,
  87                 UserRecord **ret_converted_user,
  88                 GroupRecord **ret_converted_group) {
  89
  90         _cleanup_(group_record_unrefp) GroupRecord *converted_group = NULL;
  91         _cleanup_(user_record_unrefp) UserRecord *converted_user = NULL;
  92         _cleanup_free_ char *h = NULL;
  93         JsonVariant *p, *hp = NULL;
  94         int r;
  95
  96         assert(u);
  97         assert(g);
  98         assert(u->gid == g->gid);
  99
 100         r = check_etc_passwd_collisions(directory, u->user_name, UID_INVALID);
 101         if (r < 0)
 102                 return r;
 103         if (r > 0)
 104                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY),
 105                                        "Sorry, the user '%s' already exists in the container.", u->user_name);
 106
 107         r = check_etc_group_collisions(directory, g->group_name, GID_INVALID);
 108         if (r < 0)
 109                 return r;
 110         if (r > 0)
 111                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY),
 112                                        "Sorry, the group '%s' already exists in the container.", g->group_name);
 113
 114         h = path_join("/run/host/home/", u->user_name);
 115         if (!h)
 116                 return log_oom();
 117
 118         /* Acquire the source hashed password array as-is, so that it retains the JSON_VARIANT_SENSITIVE flag */
 119         p = json_variant_by_key(u->json, "privileged");
 120         if (p)
 121                 hp = json_variant_by_key(p, "hashedPassword");
 122
 123         r = user_record_build(
 124                         &converted_user,
 125                         JSON_BUILD_OBJECT(
 126                                         JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(u->user_name)),
 127                                         JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(allocate_uid)),
 128                                         JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(allocate_uid)),
 129                                         JSON_BUILD_PAIR_CONDITION(u->disposition >= 0, "disposition", JSON_BUILD_STRING(user_disposition_to_string(u->disposition))),
 130                                         JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING(h)),
 131                                         JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.NSpawn")),
 132                                         JSON_BUILD_PAIR_CONDITION(!strv_isempty(u->hashed_password), "privileged", JSON_BUILD_OBJECT(
 133                                                                                   JSON_BUILD_PAIR("hashedPassword", JSON_BUILD_VARIANT(hp))))));
 134         if (r < 0)
 135                 return log_error_errno(r, "Failed to build container user record: %m");
 136
 137         r = group_record_build(
 138                         &converted_group,
 139                         JSON_BUILD_OBJECT(
 140                                         JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(g->group_name)),
 141                                         JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(allocate_uid)),
 142                                         JSON_BUILD_PAIR_CONDITION(g->disposition >= 0, "disposition", JSON_BUILD_STRING(user_disposition_to_string(g->disposition))),
 143                                         JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.NSpawn"))));
 144         if (r < 0)
 145                 return log_error_errno(r, "Failed to build container group record: %m");
 146
 147         *ret_converted_user = TAKE_PTR(converted_user);
 148         *ret_converted_group = TAKE_PTR(converted_group);
 149
 150         return 0;
 151 }
 152
 153 static int find_free_uid(const char *directory, uid_t max_uid, uid_t *current_uid) {
 154         int r;
 155
 156         assert(directory);
 157         assert(current_uid);
 158
 159         for (;; (*current_uid) ++) {
 160                 if (*current_uid > MAP_UID_END || *current_uid > max_uid)
 161                         return log_error_errno(
 162                                         SYNTHETIC_ERRNO(EBUSY),
 163                                         "No suitable available UID in range " UID_FMT "…" UID_FMT " in container detected, can't map user.",
 164                                         MAP_UID_START, MAP_UID_END);
 165
 166                 r = check_etc_passwd_collisions(directory, NULL, *current_uid);
 167                 if (r < 0)
 168                         return r;
 169                 if (r > 0) /* already used */
 170                         continue;
 171
 172                 /* We want to use the UID also as GID, hence check for it in /etc/group too */
 173                 r = check_etc_group_collisions(directory, NULL, (gid_t) *current_uid);
 174                 if (r < 0)
 175                         return r;
 176                 if (r == 0) /* free! yay! */
 177                         return 0;
 178         }
 179 }
 180
 181 BindUserContext* bind_user_context_free(BindUserContext *c) {
 182         if (!c)
 183                 return NULL;
 184
 185         assert(c->n_data == 0 || c->data);
 186
 187         for (size_t i = 0; i < c->n_data; i++) {
 188                 user_record_unref(c->data[i].host_user);
 189                 group_record_unref(c->data[i].host_group);
 190                 user_record_unref(c->data[i].payload_user);
 191                 group_record_unref(c->data[i].payload_group);
 192         }
 193
 194         return mfree(c);
 195 }
 196
 197 int bind_user_prepare(
 198                 const char *directory,
 199                 char **bind_user,
 200                 uid_t uid_shift,
 201                 uid_t uid_range,
 202                 CustomMount **custom_mounts,
 203                 size_t *n_custom_mounts,
 204                 BindUserContext **ret) {
 205
 206         _cleanup_(bind_user_context_freep) BindUserContext *c = NULL;
 207         uid_t current_uid = MAP_UID_START;
 208         char **n;
 209         int r;
 210
 211         assert(custom_mounts);
 212         assert(n_custom_mounts);
 213         assert(ret);
 214
 215         /* This resolves the users specified in 'bind_user', generates a minimalized JSON user + group record
 216          * for it to stick in the container, allocates a UID/GID for it, and updates the custom mount table,
 217          * to include an appropriate bind mount mapping.
 218          *
 219          * This extends the passed custom_mounts/n_custom_mounts with the home directories, and allocates a
 220          * new BindUserContext for the user records */
 221
 222         if (strv_isempty(bind_user)) {
 223                 *ret = NULL;
 224                 return 0;
 225         }
 226
 227         c = new0(BindUserContext, 1);
 228         if (!c)
 229                 return log_oom();
 230
 231         STRV_FOREACH(n, bind_user) {
 232                 _cleanup_(user_record_unrefp) UserRecord *u = NULL, *cu = NULL;
 233                 _cleanup_(group_record_unrefp) GroupRecord *g = NULL, *cg = NULL;
 234                 _cleanup_free_ char *sm = NULL, *sd = NULL;
 235                 CustomMount *cm;
 236
 237                 r = userdb_by_name(*n, USERDB_DONT_SYNTHESIZE, &u);
 238                 if (r < 0)
 239                         return log_error_errno(r, "Failed to resolve user '%s': %m", *n);
 240
 241                 /* For now, let's refuse mapping the root/nobody users explicitly. The records we generate
 242                  * are strictly additive, nss-systemd is typically placed last in /etc/nsswitch.conf. Thus
 243                  * even if we wanted, we couldn't override the root or nobody user records. Note we also
 244                  * check for name conflicts in /etc/passwd + /etc/group later on, which would usually filter
 245                  * out root/nobody too, hence these checks might appear redundant — but they actually are
 246                  * not, as we want to support environments where /etc/passwd and /etc/group are non-existent,
 247                  * and the user/group databases fully synthesized at runtime. Moreover, the name of the
 248                  * user/group name of the "nobody" account differs between distros, hence a check by numeric
 249                  * UID is safer. */
 250                 if (u->uid == 0 || streq(u->user_name, "root"))
 251                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Mapping 'root' user not supported, sorry.");
 252                 if (u->uid == UID_NOBODY || STR_IN_SET(u->user_name, NOBODY_USER_NAME, "nobody"))
 253                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Mapping 'nobody' user not supported, sorry.");
 254
 255                 if (u->uid >= uid_shift && u->uid < uid_shift + uid_range)
 256                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID of user '%s' to map is already in container UID range, refusing.", u->user_name);
 257
 258                 r = groupdb_by_gid(u->gid, USERDB_DONT_SYNTHESIZE, &g);
 259                 if (r < 0)
 260                         return log_error_errno(r, "Failed to resolve group of user '%s': %m", u->user_name);
 261
 262                 if (g->gid >= uid_shift && g->gid < uid_shift + uid_range)
 263                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "GID of group '%s' to map is already in container GID range, refusing.", g->group_name);
 264
 265                 /* We want to synthesize exactly one user + group from the host into the container. This only
 266                  * makes sense if the user on the host has its own private group. We can't reasonably check
 267                  * this, so we just check of the name of user and group match.
 268                  *
 269                  * One of these days we might want to support users in a shared/common group too, but it's
 270                  * not clear to me how this would have to be mapped, precisely given that the common group
 271                  * probably already exists in the container. */
 272                 if (!streq(u->user_name, g->group_name))
 273                         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
 274                                                "Sorry, mapping users without private groups is currently not supported.");
 275
 276                 r = find_free_uid(directory, uid_range, &current_uid);
 277                 if (r < 0)
 278                         return r;
 279
 280                 r = convert_user(directory, u, g, current_uid, &cu, &cg);
 281                 if (r < 0)
 282                         return r;
 283
 284                 if (!GREEDY_REALLOC(c->data, c->n_data + 1))
 285                         return log_oom();
 286
 287                 sm = strdup(u->home_directory);
 288                 if (!sm)
 289                         return log_oom();
 290
 291                 sd = strdup(cu->home_directory);
 292                 if (!sd)
 293                         return log_oom();
 294
 295                 cm = reallocarray(*custom_mounts, sizeof(CustomMount), *n_custom_mounts + 1);
 296                 if (!cm)
 297                         return log_oom();
 298
 299                 *custom_mounts = cm;
 300
 301                 (*custom_mounts)[(*n_custom_mounts)++] = (CustomMount) {
 302                         .type = CUSTOM_MOUNT_BIND,
 303                         .source = TAKE_PTR(sm),
 304                         .destination = TAKE_PTR(sd),
 305                 };
 306
 307                 c->data[c->n_data++] = (BindUserData) {
 308                         .host_user = TAKE_PTR(u),
 309                         .host_group = TAKE_PTR(g),
 310                         .payload_user = TAKE_PTR(cu),
 311                         .payload_group = TAKE_PTR(cg),
 312                 };
 313
 314                 current_uid++;
 315         }
 316
 317         *ret = TAKE_PTR(c);
 318         return 1;
 319 }
 320
 321 static int write_and_symlink(
 322                 const char *root,
 323                 JsonVariant *v,
 324                 const char *name,
 325                 uid_t uid,
 326                 const char *suffix,
 327                 WriteStringFileFlags extra_flags) {
 328
 329         _cleanup_free_ char *j = NULL, *f = NULL, *p = NULL, *q = NULL;
 330         int r;
 331
 332         assert(root);
 333         assert(v);
 334         assert(name);
 335         assert(uid_is_valid(uid));
 336         assert(suffix);
 337
 338         r = json_variant_format(v, JSON_FORMAT_NEWLINE, &j);
 339         if (r < 0)
 340                 return log_error_errno(r, "Failed to format user record JSON: %m");
 341
 342         f = strjoin(name, suffix);
 343         if (!f)
 344                 return log_oom();
 345
 346         p = path_join(root, "/run/host/userdb/", f);
 347         if (!p)
 348                 return log_oom();
 349
 350         if (asprintf(&q, "%s/run/host/userdb/" UID_FMT "%s", root, uid, suffix) < 0)
 351                 return log_oom();
 352
 353         if (symlink(f, q) < 0)
 354                 return log_error_errno(errno, "Failed to create symlink '%s': %m", q);
 355
 356         r = userns_lchown(q, 0, 0);
 357         if (r < 0)
 358                 return log_error_errno(r, "Failed to adjust access mode of '%s': %m", q);
 359
 360         r = write_string_file(p, j, WRITE_STRING_FILE_CREATE|extra_flags);
 361         if (r < 0)
 362                 return log_error_errno(r, "Failed to write %s: %m", p);
 363
 364         r = userns_lchown(p, 0, 0);
 365         if (r < 0)
 366                 return log_error_errno(r, "Failed to adjust access mode of '%s': %m", p);
 367
 368         return 0;
 369 }
 370
 371 int bind_user_setup(
 372                 const BindUserContext *c,
 373                 const char *root) {
 374
 375         static const UserRecordLoadFlags strip_flags = /* Removes privileged info */
 376                 USER_RECORD_REQUIRE_REGULAR|
 377                 USER_RECORD_STRIP_PRIVILEGED|
 378                 USER_RECORD_ALLOW_PER_MACHINE|
 379                 USER_RECORD_ALLOW_BINDING|
 380                 USER_RECORD_ALLOW_SIGNATURE|
 381                 USER_RECORD_PERMISSIVE;
 382         static const UserRecordLoadFlags shadow_flags = /* Extracts privileged info */
 383                 USER_RECORD_STRIP_REGULAR|
 384                 USER_RECORD_ALLOW_PRIVILEGED|
 385                 USER_RECORD_STRIP_PER_MACHINE|
 386                 USER_RECORD_STRIP_BINDING|
 387                 USER_RECORD_STRIP_SIGNATURE|
 388                 USER_RECORD_EMPTY_OK|
 389                 USER_RECORD_PERMISSIVE;
 390         int r;
 391
 392         assert(root);
 393
 394         if (!c || c->n_data == 0)
 395                 return 0;
 396
 397         r = userns_mkdir(root, "/run/host", 0755, 0, 0);
 398         if (r < 0)
 399                 return log_error_errno(r, "Failed to create /run/host: %m");
 400
 401         r = userns_mkdir(root, "/run/host/home", 0755, 0, 0);
 402         if (r < 0)
 403                 return log_error_errno(r, "Failed to create /run/host/userdb: %m");
 404
 405         r = userns_mkdir(root, "/run/host/userdb", 0755, 0, 0);
 406         if (r < 0)
 407                 return log_error_errno(r, "Failed to create /run/host/userdb: %m");
 408
 409         for (size_t i = 0; i < c->n_data; i++) {
 410                 _cleanup_(group_record_unrefp) GroupRecord *stripped_group = NULL, *shadow_group = NULL;
 411                 _cleanup_(user_record_unrefp) UserRecord *stripped_user = NULL, *shadow_user = NULL;
 412                 const BindUserData *d = c->data + i;
 413
 414                 /* First, write shadow (i.e. privileged) data for group record */
 415                 r = group_record_clone(d->payload_group, shadow_flags, &shadow_group);
 416                 if (r < 0)
 417                         return log_error_errno(r, "Failed to extract privileged information from group record: %m");
 418
 419                 if (!json_variant_is_blank_object(shadow_group->json)) {
 420                         r = write_and_symlink(
 421                                         root,
 422                                         shadow_group->json,
 423                                         d->payload_group->group_name,
 424                                         d->payload_group->gid,
 425                                         ".group-privileged",
 426                                         WRITE_STRING_FILE_MODE_0600);
 427                         if (r < 0)
 428                                 return r;
 429                 }
 430
 431                 /* Second, write main part of group record. */
 432                 r = group_record_clone(d->payload_group, strip_flags, &stripped_group);
 433                 if (r < 0)
 434                         return log_error_errno(r, "Failed to strip privileged information from group record: %m");
 435
 436                 r = write_and_symlink(
 437                                 root,
 438                                 stripped_group->json,
 439                                 d->payload_group->group_name,
 440                                 d->payload_group->gid,
 441                                 ".group",
 442                                 0);
 443                 if (r < 0)
 444                         return r;
 445
 446                 /* Third, write out user shadow data. i.e. extract privileged info from user record */
 447                 r = user_record_clone(d->payload_user, shadow_flags, &shadow_user);
 448                 if (r < 0)
 449                         return log_error_errno(r, "Failed to extract privileged information from user record: %m");
 450
 451                 if (!json_variant_is_blank_object(shadow_user->json)) {
 452                         r = write_and_symlink(
 453                                         root,
 454                                         shadow_user->json,
 455                                         d->payload_user->user_name,
 456                                         d->payload_user->uid,
 457                                         ".user-privileged",
 458                                         WRITE_STRING_FILE_MODE_0600);
 459                         if (r < 0)
 460                                 return r;
 461                 }
 462
 463                 /* Finally write out the main part of the user record */
 464                 r = user_record_clone(d->payload_user, strip_flags, &stripped_user);
 465                 if (r < 0)
 466                         return log_error_errno(r, "Failed to strip privileged information from user record: %m");
 467
 468                 r = write_and_symlink(
 469                                 root,
 470                                 stripped_user->json,
 471                                 d->payload_user->user_name,
 472                                 d->payload_user->uid,
 473                                 ".user",
 474                                 0);
 475                 if (r < 0)
 476                         return r;
 477         }
 478
 479         return 1;
 480 }