2 * unshare(1) - command-line interface for unshare(2)
4 * Copyright (C) 2009 Mikhail Gusarov <dottedmag@dottedmag.net>
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2, or (at your option) any
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * General Public License for more details.
16 * You should have received a copy of the GNU General Public License along
17 * with this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
28 #include <sys/mount.h>
29 #include <sys/types.h>
31 #include <sys/prctl.h>
34 /* we only need some defines missing in sys/mount.h, no libmount linkage */
39 #include "closestream.h"
40 #include "namespace.h"
41 #include "exec_shell.h"
43 #include "pathnames.h"
48 /* synchronize parent and child by pipe */
49 #define PIPE_SYNC_BYTE 0x06
51 /* 'private' is kernel default */
52 #define UNSHARE_PROPAGATION_DEFAULT (MS_REC | MS_PRIVATE)
54 /* /proc namespace files and mountpoints for binds */
55 static struct namespace_file
{
56 int type
; /* CLONE_NEW* */
57 const char *name
; /* ns/<type> */
58 const char *target
; /* user specified target for bind mount */
59 } namespace_files
[] = {
60 { .type
= CLONE_NEWUSER
, .name
= "ns/user" },
61 { .type
= CLONE_NEWCGROUP
,.name
= "ns/cgroup" },
62 { .type
= CLONE_NEWIPC
, .name
= "ns/ipc" },
63 { .type
= CLONE_NEWUTS
, .name
= "ns/uts" },
64 { .type
= CLONE_NEWNET
, .name
= "ns/net" },
65 { .type
= CLONE_NEWPID
, .name
= "ns/pid" },
66 { .type
= CLONE_NEWNS
, .name
= "ns/mnt" },
70 static int npersists
; /* number of persistent namespaces */
79 static const char *setgroups_strings
[] =
81 [SETGROUPS_DENY
] = "deny",
82 [SETGROUPS_ALLOW
] = "allow"
85 static int setgroups_str2id(const char *str
)
89 for (i
= 0; i
< ARRAY_SIZE(setgroups_strings
); i
++)
90 if (strcmp(str
, setgroups_strings
[i
]) == 0)
93 errx(EXIT_FAILURE
, _("unsupported --setgroups argument '%s'"), str
);
96 static void setgroups_control(int action
)
98 const char *file
= _PATH_PROC_SETGROUPS
;
102 if (action
< 0 || (size_t) action
>= ARRAY_SIZE(setgroups_strings
))
104 cmd
= setgroups_strings
[action
];
106 fd
= open(file
, O_WRONLY
);
110 err(EXIT_FAILURE
, _("cannot open %s"), file
);
113 if (write_all(fd
, cmd
, strlen(cmd
)))
114 err(EXIT_FAILURE
, _("write failed %s"), file
);
118 static void map_id(const char *file
, uint32_t from
, uint32_t to
)
123 fd
= open(file
, O_WRONLY
);
125 err(EXIT_FAILURE
, _("cannot open %s"), file
);
127 xasprintf(&buf
, "%u %u 1", from
, to
);
128 if (write_all(fd
, buf
, strlen(buf
)))
129 err(EXIT_FAILURE
, _("write failed %s"), file
);
134 static unsigned long parse_propagation(const char *str
)
137 static const struct prop_opts
{
141 { "slave", MS_REC
| MS_SLAVE
},
142 { "private", MS_REC
| MS_PRIVATE
},
143 { "shared", MS_REC
| MS_SHARED
},
147 for (i
= 0; i
< ARRAY_SIZE(opts
); i
++) {
148 if (strcmp(opts
[i
].name
, str
) == 0)
152 errx(EXIT_FAILURE
, _("unsupported propagation mode: %s"), str
);
155 static void set_propagation(unsigned long flags
)
160 if (mount("none", "/", NULL
, flags
, NULL
) != 0)
161 err(EXIT_FAILURE
, _("cannot change root filesystem propagation"));
165 static int set_ns_target(int type
, const char *path
)
167 struct namespace_file
*ns
;
169 for (ns
= namespace_files
; ns
->name
; ns
++) {
170 if (ns
->type
!= type
)
180 static int bind_ns_files(pid_t pid
)
182 struct namespace_file
*ns
;
185 for (ns
= namespace_files
; ns
->name
; ns
++) {
189 snprintf(src
, sizeof(src
), "/proc/%u/%s", (unsigned) pid
, ns
->name
);
191 if (mount(src
, ns
->target
, NULL
, MS_BIND
, NULL
) != 0)
192 err(EXIT_FAILURE
, _("mount %s on %s failed"), src
, ns
->target
);
198 static ino_t
get_mnt_ino(pid_t pid
)
203 snprintf(path
, sizeof(path
), "/proc/%u/ns/mnt", (unsigned) pid
);
205 if (stat(path
, &st
) != 0)
206 err(EXIT_FAILURE
, _("cannot stat %s"), path
);
210 static void bind_ns_files_from_child(pid_t
*child
, int fds
[2])
213 pid_t ppid
= getpid();
214 ino_t ino
= get_mnt_ino(ppid
);
217 err(EXIT_FAILURE
, _("pipe failed"));
223 err(EXIT_FAILURE
, _("fork failed"));
229 /* wait for parent */
230 if (read_all(fds
[0], &ch
, 1) != 1 && ch
!= PIPE_SYNC_BYTE
)
231 err(EXIT_FAILURE
, _("failed to read pipe"));
232 if (get_mnt_ino(ppid
) == ino
)
238 default: /* parent */
245 static void __attribute__((__noreturn__
)) usage(void)
249 fputs(USAGE_HEADER
, out
);
250 fprintf(out
, _(" %s [options] [<program> [<argument>...]]\n"),
251 program_invocation_short_name
);
253 fputs(USAGE_SEPARATOR
, out
);
254 fputs(_("Run a program with some namespaces unshared from the parent.\n"), out
);
256 fputs(USAGE_OPTIONS
, out
);
257 fputs(_(" -m, --mount[=<file>] unshare mounts namespace\n"), out
);
258 fputs(_(" -u, --uts[=<file>] unshare UTS namespace (hostname etc)\n"), out
);
259 fputs(_(" -i, --ipc[=<file>] unshare System V IPC namespace\n"), out
);
260 fputs(_(" -n, --net[=<file>] unshare network namespace\n"), out
);
261 fputs(_(" -p, --pid[=<file>] unshare pid namespace\n"), out
);
262 fputs(_(" -U, --user[=<file>] unshare user namespace\n"), out
);
263 fputs(_(" -C, --cgroup[=<file>] unshare cgroup namespace\n"), out
);
264 fputs(USAGE_SEPARATOR
, out
);
265 fputs(_(" -f, --fork fork before launching <program>\n"), out
);
266 fputs(_(" -r, --map-root-user map current user to root (implies --user)\n"), out
);
267 fputs(USAGE_SEPARATOR
, out
);
268 fputs(_(" --kill-child[=<signame>] when dying, kill the forked child (implies --fork)\n"
269 " defaults to SIGKILL\n"), out
);
270 fputs(_(" --mount-proc[=<dir>] mount proc filesystem first (implies --mount)\n"), out
);
271 fputs(_(" --propagation slave|shared|private|unchanged\n"
272 " modify mount propagation in mount namespace\n"), out
);
273 fputs(_(" --setgroups allow|deny control the setgroups syscall in user namespaces\n"), out
);
274 fputs(USAGE_SEPARATOR
, out
);
275 fputs(_(" -R, --root=<dir> run the command with root directory set to <dir>\n"), out
);
276 fputs(_(" -w, --wd=<dir> change working directory to <dir>\n"), out
);
277 fputs(_(" -S, --setuid <uid> set uid in entered namespace\n"), out
);
278 fputs(_(" -G, --setgid <gid> set gid in entered namespace\n"), out
);
280 fputs(USAGE_SEPARATOR
, out
);
281 printf(USAGE_HELP_OPTIONS(27));
282 printf(USAGE_MAN_TAIL("unshare(1)"));
287 int main(int argc
, char *argv
[])
290 OPT_MOUNTPROC
= CHAR_MAX
+ 1,
295 static const struct option longopts
[] = {
296 { "help", no_argument
, NULL
, 'h' },
297 { "version", no_argument
, NULL
, 'V' },
299 { "mount", optional_argument
, NULL
, 'm' },
300 { "uts", optional_argument
, NULL
, 'u' },
301 { "ipc", optional_argument
, NULL
, 'i' },
302 { "net", optional_argument
, NULL
, 'n' },
303 { "pid", optional_argument
, NULL
, 'p' },
304 { "user", optional_argument
, NULL
, 'U' },
305 { "cgroup", optional_argument
, NULL
, 'C' },
307 { "fork", no_argument
, NULL
, 'f' },
308 { "kill-child", optional_argument
, NULL
, OPT_KILLCHILD
},
309 { "mount-proc", optional_argument
, NULL
, OPT_MOUNTPROC
},
310 { "map-root-user", no_argument
, NULL
, 'r' },
311 { "propagation", required_argument
, NULL
, OPT_PROPAGATION
},
312 { "setgroups", required_argument
, NULL
, OPT_SETGROUPS
},
313 { "setuid", required_argument
, NULL
, 'S' },
314 { "setgid", required_argument
, NULL
, 'G' },
315 { "root", required_argument
, NULL
, 'R' },
316 { "wd", required_argument
, NULL
, 'w' },
320 int setgrpcmd
= SETGROUPS_NONE
;
321 int unshare_flags
= 0;
322 int c
, forkit
= 0, maproot
= 0;
323 int kill_child_signo
= 0; /* 0 means --kill-child was not used */
324 const char *procmnt
= NULL
;
325 const char *newroot
= NULL
;
326 const char *newdir
= NULL
;
330 unsigned long propagation
= UNSHARE_PROPAGATION_DEFAULT
;
331 int force_uid
= 0, force_gid
= 0;
332 uid_t uid
= 0, real_euid
= geteuid();
333 gid_t gid
= 0, real_egid
= getegid();
335 setlocale(LC_ALL
, "");
336 bindtextdomain(PACKAGE
, LOCALEDIR
);
338 close_stdout_atexit();
340 while ((c
= getopt_long(argc
, argv
, "+fhVmuinpCUrR:w:S:G:", longopts
, NULL
)) != -1) {
346 unshare_flags
|= CLONE_NEWNS
;
348 set_ns_target(CLONE_NEWNS
, optarg
);
351 unshare_flags
|= CLONE_NEWUTS
;
353 set_ns_target(CLONE_NEWUTS
, optarg
);
356 unshare_flags
|= CLONE_NEWIPC
;
358 set_ns_target(CLONE_NEWIPC
, optarg
);
361 unshare_flags
|= CLONE_NEWNET
;
363 set_ns_target(CLONE_NEWNET
, optarg
);
366 unshare_flags
|= CLONE_NEWPID
;
368 set_ns_target(CLONE_NEWPID
, optarg
);
371 unshare_flags
|= CLONE_NEWUSER
;
373 set_ns_target(CLONE_NEWUSER
, optarg
);
376 unshare_flags
|= CLONE_NEWCGROUP
;
378 set_ns_target(CLONE_NEWCGROUP
, optarg
);
381 unshare_flags
|= CLONE_NEWNS
;
382 procmnt
= optarg
? optarg
: "/proc";
385 unshare_flags
|= CLONE_NEWUSER
;
389 setgrpcmd
= setgroups_str2id(optarg
);
391 case OPT_PROPAGATION
:
392 propagation
= parse_propagation(optarg
);
397 if ((kill_child_signo
= signame_to_signum(optarg
)) < 0)
398 errx(EXIT_FAILURE
, _("unknown signal: %s"),
401 kill_child_signo
= SIGKILL
;
405 uid
= strtoul_or_err(optarg
, _("failed to parse uid"));
409 gid
= strtoul_or_err(optarg
, _("failed to parse gid"));
422 print_version(EXIT_SUCCESS
);
424 errtryhelp(EXIT_FAILURE
);
428 if (npersists
&& (unshare_flags
& CLONE_NEWNS
))
429 bind_ns_files_from_child(&pid
, fds
);
431 if (-1 == unshare(unshare_flags
))
432 err(EXIT_FAILURE
, _("unshare failed"));
435 if (pid
&& (unshare_flags
& CLONE_NEWNS
)) {
437 char ch
= PIPE_SYNC_BYTE
;
439 /* signal child we are ready */
440 write_all(fds
[1], &ch
, 1);
444 /* wait for bind_ns_files_from_child() */
446 rc
= waitpid(pid
, &status
, 0);
450 err(EXIT_FAILURE
, _("waitpid failed"));
452 if (WIFEXITED(status
) &&
453 WEXITSTATUS(status
) != EXIT_SUCCESS
)
454 return WEXITSTATUS(status
);
457 /* simple way, just bind */
458 bind_ns_files(getpid());
466 err(EXIT_FAILURE
, _("fork failed"));
469 default: /* parent */
470 if (waitpid(pid
, &status
, 0) == -1)
471 err(EXIT_FAILURE
, _("waitpid failed"));
472 if (WIFEXITED(status
))
473 return WEXITSTATUS(status
);
474 else if (WIFSIGNALED(status
))
475 kill(getpid(), WTERMSIG(status
));
476 err(EXIT_FAILURE
, _("child exit failed"));
480 if (kill_child_signo
!= 0 && prctl(PR_SET_PDEATHSIG
, kill_child_signo
) < 0)
481 err(EXIT_FAILURE
, "prctl failed");
484 if (setgrpcmd
== SETGROUPS_ALLOW
)
485 errx(EXIT_FAILURE
, _("options --setgroups=allow and "
486 "--map-root-user are mutually exclusive"));
488 /* since Linux 3.19 unprivileged writing of /proc/self/gid_map
489 * has s been disabled unless /proc/self/setgroups is written
490 * first to permanently disable the ability to call setgroups
491 * in that user namespace. */
492 setgroups_control(SETGROUPS_DENY
);
493 map_id(_PATH_PROC_UIDMAP
, 0, real_euid
);
494 map_id(_PATH_PROC_GIDMAP
, 0, real_egid
);
496 } else if (setgrpcmd
!= SETGROUPS_NONE
)
497 setgroups_control(setgrpcmd
);
499 if ((unshare_flags
& CLONE_NEWNS
) && propagation
)
500 set_propagation(propagation
);
503 if (chroot(newroot
) != 0)
505 _("cannot change root directory to '%s'"), newroot
);
506 newdir
= newdir
?: "/";
508 if (newdir
&& chdir(newdir
))
509 err(EXIT_FAILURE
, _("cannot chdir to '%s'"), newdir
);
512 if (!newroot
&& mount("none", procmnt
, NULL
, MS_PRIVATE
|MS_REC
, NULL
) != 0)
513 err(EXIT_FAILURE
, _("umount %s failed"), procmnt
);
514 if (mount("proc", procmnt
, "proc", MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, NULL
) != 0)
515 err(EXIT_FAILURE
, _("mount %s failed"), procmnt
);
519 if (setgroups(0, NULL
) != 0) /* drop supplementary groups */
520 err(EXIT_FAILURE
, _("setgroups failed"));
521 if (setgid(gid
) < 0) /* change GID */
522 err(EXIT_FAILURE
, _("setgid failed"));
524 if (force_uid
&& setuid(uid
) < 0) /* change UID */
525 err(EXIT_FAILURE
, _("setuid failed"));
528 execvp(argv
[optind
], argv
+ optind
);
529 errexec(argv
[optind
]);