src/core/namespace.h

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 #pragma once
   3
   4 /***
   5   Copyright © 2016 Djalal Harouni
   6 ***/
   7
   8 #include "forward.h"
   9 #include "list.h"
  10 #include "runtime-scope.h"
  11
  12 typedef enum ProtectHome {
  13         PROTECT_HOME_NO,
  14         PROTECT_HOME_YES,
  15         PROTECT_HOME_READ_ONLY,
  16         PROTECT_HOME_TMPFS,
  17         _PROTECT_HOME_MAX,
  18         _PROTECT_HOME_INVALID = -EINVAL,
  19 } ProtectHome;
  20
  21 typedef enum ProtectHostname {
  22         PROTECT_HOSTNAME_NO,
  23         PROTECT_HOSTNAME_YES,
  24         PROTECT_HOSTNAME_PRIVATE,
  25         _PROTECT_HOSTNAME_MAX,
  26         _PROTECT_HOSTNAME_INVALID = -EINVAL,
  27 } ProtectHostname;
  28
  29 typedef enum ProtectSystem {
  30         PROTECT_SYSTEM_NO,
  31         PROTECT_SYSTEM_YES,
  32         PROTECT_SYSTEM_FULL,
  33         PROTECT_SYSTEM_STRICT,
  34         _PROTECT_SYSTEM_MAX,
  35         _PROTECT_SYSTEM_INVALID = -EINVAL,
  36 } ProtectSystem;
  37
  38 typedef enum ProtectProc {
  39         PROTECT_PROC_DEFAULT,
  40         PROTECT_PROC_NOACCESS,   /* hidepid=noaccess */
  41         PROTECT_PROC_INVISIBLE,  /* hidepid=invisible */
  42         PROTECT_PROC_PTRACEABLE, /* hidepid=ptraceable */
  43         _PROTECT_PROC_MAX,
  44         _PROTECT_PROC_INVALID = -EINVAL,
  45 } ProtectProc;
  46
  47 typedef enum ProcSubset {
  48         PROC_SUBSET_ALL,
  49         PROC_SUBSET_PID, /* subset=pid */
  50         _PROC_SUBSET_MAX,
  51         _PROC_SUBSET_INVALID = -EINVAL,
  52 } ProcSubset;
  53
  54 typedef enum PrivateTmp {
  55         PRIVATE_TMP_NO,
  56         PRIVATE_TMP_CONNECTED, /* Bind mounted from the host's filesystem */
  57         PRIVATE_TMP_DISCONNECTED, /* A completely private tmpfs, invisible from the host */
  58         _PRIVATE_TMP_MAX,
  59         _PRIVATE_TMP_INVALID = -EINVAL,
  60 } PrivateTmp;
  61
  62 typedef enum PrivateUsers {
  63         PRIVATE_USERS_NO,
  64         PRIVATE_USERS_SELF,
  65         PRIVATE_USERS_IDENTITY,
  66         PRIVATE_USERS_FULL,
  67         _PRIVATE_USERS_MAX,
  68         _PRIVATE_USERS_INVALID = -EINVAL,
  69 } PrivateUsers;
  70
  71 typedef enum ProtectControlGroups {
  72         PROTECT_CONTROL_GROUPS_NO,
  73         PROTECT_CONTROL_GROUPS_YES,
  74         PROTECT_CONTROL_GROUPS_PRIVATE,
  75         PROTECT_CONTROL_GROUPS_STRICT,
  76         _PROTECT_CONTROL_GROUPS_MAX,
  77         _PROTECT_CONTROL_GROUPS_INVALID = -EINVAL,
  78 } ProtectControlGroups;
  79
  80 typedef enum PrivatePIDs {
  81         PRIVATE_PIDS_NO,
  82         PRIVATE_PIDS_YES,
  83         _PRIVATE_PIDS_MAX,
  84         _PRIVATE_PIDS_INVALID = -EINVAL,
  85 } PrivatePIDs;
  86
  87 typedef struct BindMount {
  88         char *source;
  89         char *destination;
  90         bool read_only;
  91         bool nodev;
  92         bool nosuid;
  93         bool noexec;
  94         bool recursive;
  95         bool ignore_enoent;
  96         bool idmapped;
  97         uid_t uid;
  98         gid_t gid;
  99 } BindMount;
 100
 101 typedef struct TemporaryFileSystem {
 102         char *path;
 103         char *options;
 104 } TemporaryFileSystem;
 105
 106 typedef enum MountImageType {
 107         MOUNT_IMAGE_DISCRETE,
 108         MOUNT_IMAGE_EXTENSION,
 109         _MOUNT_IMAGE_TYPE_MAX,
 110         _MOUNT_IMAGE_TYPE_INVALID = -EINVAL,
 111 } MountImageType;
 112
 113 typedef struct MountImage {
 114         char *source;
 115         char *destination; /* Unused if MountImageType == MOUNT_IMAGE_EXTENSION */
 116         LIST_HEAD(MountOptions, mount_options);
 117         bool ignore_enoent;
 118         MountImageType type;
 119 } MountImage;
 120
 121 typedef struct NamespaceParameters {
 122         RuntimeScope runtime_scope;
 123
 124         const char *root_directory;
 125         const char *root_image;
 126         const MountOptions *root_image_options;
 127         const ImagePolicy *root_image_policy;
 128
 129         char **read_write_paths;
 130         char **read_only_paths;
 131         char **inaccessible_paths;
 132
 133         char **exec_paths;
 134         char **no_exec_paths;
 135
 136         char **empty_directories;
 137         char **symlinks;
 138
 139         const BindMount *bind_mounts;
 140         size_t n_bind_mounts;
 141
 142         const TemporaryFileSystem *temporary_filesystems;
 143         size_t n_temporary_filesystems;
 144
 145         const MountImage *mount_images;
 146         size_t n_mount_images;
 147         const ImagePolicy *mount_image_policy;
 148
 149         const char *tmp_dir;
 150         const char *var_tmp_dir;
 151
 152         const char *creds_path;
 153         const char *log_namespace;
 154
 155         unsigned long mount_propagation_flag;
 156         VeritySettings *verity;
 157
 158         const MountImage *extension_images;
 159         size_t n_extension_images;
 160         const ImagePolicy *extension_image_policy;
 161         char **extension_directories;
 162
 163         const char *propagate_dir;
 164         const char *incoming_dir;
 165
 166         const char *private_namespace_dir;
 167         const char *host_notify_socket;
 168         const char *notify_socket_path;
 169         const char *host_os_release_stage;
 170
 171         bool ignore_protect_paths;
 172
 173         bool protect_kernel_tunables;
 174         bool protect_kernel_modules;
 175         bool protect_kernel_logs;
 176
 177         bool private_dev;
 178         bool private_network;
 179         bool private_ipc;
 180
 181         bool mount_apivfs;
 182         bool bind_log_sockets;
 183         bool mount_nosuid;
 184
 185         ProtectControlGroups protect_control_groups;
 186         ProtectHome protect_home;
 187         ProtectHostname protect_hostname;
 188         ProtectSystem protect_system;
 189         ProtectProc protect_proc;
 190         ProcSubset proc_subset;
 191         PrivateTmp private_tmp;
 192         PrivateTmp private_var_tmp;
 193         PrivatePIDs private_pids;
 194 } NamespaceParameters;
 195
 196 int setup_namespace(const NamespaceParameters *p, char **reterr_path);
 197
 198 #define RUN_SYSTEMD_EMPTY "/run/systemd/empty"
 199
 200 char* namespace_cleanup_tmpdir(char *p);
 201 DEFINE_TRIVIAL_CLEANUP_FUNC(char*, namespace_cleanup_tmpdir);
 202
 203 int setup_tmp_dirs(
 204                 const char *id,
 205                 char **tmp_dir,
 206                 char **var_tmp_dir);
 207
 208 int setup_shareable_ns(int ns_storage_socket[static 2], unsigned long nsflag);
 209 int open_shareable_ns_path(int netns_storage_socket[static 2], const char *path, unsigned long nsflag);
 210
 211 const char* protect_home_to_string(ProtectHome p) _const_;
 212 ProtectHome protect_home_from_string(const char *s) _pure_;
 213
 214 const char* protect_hostname_to_string(ProtectHostname p) _const_;
 215 ProtectHostname protect_hostname_from_string(const char *s) _pure_;
 216
 217 const char* protect_system_to_string(ProtectSystem p) _const_;
 218 ProtectSystem protect_system_from_string(const char *s) _pure_;
 219
 220 const char* protect_proc_to_string(ProtectProc i) _const_;
 221 ProtectProc protect_proc_from_string(const char *s) _pure_;
 222
 223 const char* proc_subset_to_string(ProcSubset i) _const_;
 224 ProcSubset proc_subset_from_string(const char *s) _pure_;
 225
 226 const char* private_tmp_to_string(PrivateTmp i) _const_;
 227 PrivateTmp private_tmp_from_string(const char *s) _pure_;
 228
 229 const char* private_users_to_string(PrivateUsers i) _const_;
 230 PrivateUsers private_users_from_string(const char *s) _pure_;
 231
 232 const char* protect_control_groups_to_string(ProtectControlGroups i) _const_;
 233 ProtectControlGroups protect_control_groups_from_string(const char *s) _pure_;
 234
 235 const char* private_pids_to_string(PrivatePIDs i) _const_;
 236 PrivatePIDs private_pids_from_string(const char *s) _pure_;
 237
 238 void bind_mount_free_many(BindMount *b, size_t n);
 239 int bind_mount_add(BindMount **b, size_t *n, const BindMount *item);
 240
 241 void temporary_filesystem_free_many(TemporaryFileSystem *t, size_t n);
 242 int temporary_filesystem_add(TemporaryFileSystem **t, size_t *n,
 243                              const char *path, const char *options);
 244
 245 MountImage* mount_image_free_many(MountImage *m, size_t *n);
 246 int mount_image_add(MountImage **m, size_t *n, const MountImage *item);
 247
 248 int refresh_extensions_in_namespace(
 249                 const PidRef *target,
 250                 const char *hierarchy_env,
 251                 const NamespaceParameters *p);