2 * unshare(1) - command-line interface for unshare(2)
4 * Copyright (C) 2009 Mikhail Gusarov <dottedmag@dottedmag.net>
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2, or (at your option) any
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * General Public License for more details.
16 * You should have received a copy of the GNU General Public License along
17 * with this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
28 #include <sys/eventfd.h>
30 #include <sys/mount.h>
31 #include <sys/types.h>
33 #include <sys/prctl.h>
36 /* we only need some defines missing in sys/mount.h, no libmount linkage */
42 #include "closestream.h"
43 #include "namespace.h"
44 #include "pidfd-utils.h"
45 #include "exec_shell.h"
47 #include "pathnames.h"
53 /* synchronize parent and child by pipe */
54 #define PIPE_SYNC_BYTE 0x06
56 /* 'private' is kernel default */
57 #define UNSHARE_PROPAGATION_DEFAULT (MS_REC | MS_PRIVATE)
59 /* /proc namespace files and mountpoints for binds */
60 static struct namespace_file
{
61 int type
; /* CLONE_NEW* */
62 const char *name
; /* ns/<type> */
63 const char *target
; /* user specified target for bind mount */
64 } namespace_files
[] = {
65 { .type
= CLONE_NEWUSER
, .name
= "ns/user" },
66 { .type
= CLONE_NEWCGROUP
,.name
= "ns/cgroup" },
67 { .type
= CLONE_NEWIPC
, .name
= "ns/ipc" },
68 { .type
= CLONE_NEWUTS
, .name
= "ns/uts" },
69 { .type
= CLONE_NEWNET
, .name
= "ns/net" },
70 { .type
= CLONE_NEWPID
, .name
= "ns/pid_for_children" },
71 { .type
= CLONE_NEWNS
, .name
= "ns/mnt" },
72 { .type
= CLONE_NEWTIME
, .name
= "ns/time_for_children" },
76 static int npersists
; /* number of persistent namespaces */
84 static const char *setgroups_strings
[] =
86 [SETGROUPS_DENY
] = "deny",
87 [SETGROUPS_ALLOW
] = "allow"
90 static int setgroups_str2id(const char *str
)
94 for (i
= 0; i
< ARRAY_SIZE(setgroups_strings
); i
++)
95 if (strcmp(str
, setgroups_strings
[i
]) == 0)
98 errx(EXIT_FAILURE
, _("unsupported --setgroups argument '%s'"), str
);
101 static void setgroups_control(int action
)
103 const char *file
= _PATH_PROC_SETGROUPS
;
107 if (action
< 0 || (size_t) action
>= ARRAY_SIZE(setgroups_strings
))
109 cmd
= setgroups_strings
[action
];
111 fd
= open(file
, O_WRONLY
);
115 err(EXIT_FAILURE
, _("cannot open %s"), file
);
118 if (write_all(fd
, cmd
, strlen(cmd
)))
119 err(EXIT_FAILURE
, _("write failed %s"), file
);
123 static void map_id(const char *file
, uint32_t from
, uint32_t to
)
128 fd
= open(file
, O_WRONLY
);
130 err(EXIT_FAILURE
, _("cannot open %s"), file
);
132 xasprintf(&buf
, "%u %u 1", from
, to
);
133 if (write_all(fd
, buf
, strlen(buf
)))
134 err(EXIT_FAILURE
, _("write failed %s"), file
);
139 static unsigned long parse_propagation(const char *str
)
142 static const struct prop_opts
{
146 { "slave", MS_REC
| MS_SLAVE
},
147 { "private", MS_REC
| MS_PRIVATE
},
148 { "shared", MS_REC
| MS_SHARED
},
152 for (i
= 0; i
< ARRAY_SIZE(opts
); i
++) {
153 if (strcmp(opts
[i
].name
, str
) == 0)
157 errx(EXIT_FAILURE
, _("unsupported propagation mode: %s"), str
);
160 static void set_propagation(unsigned long flags
)
165 if (mount("none", "/", NULL
, flags
, NULL
) != 0)
166 err(EXIT_FAILURE
, _("cannot change root filesystem propagation"));
170 static int set_ns_target(int type
, const char *path
)
172 struct namespace_file
*ns
;
174 for (ns
= namespace_files
; ns
->name
; ns
++) {
175 if (ns
->type
!= type
)
185 static int bind_ns_files(pid_t pid
)
187 struct namespace_file
*ns
;
190 for (ns
= namespace_files
; ns
->name
; ns
++) {
194 snprintf(src
, sizeof(src
), "/proc/%u/%s", (unsigned) pid
, ns
->name
);
196 if (mount(src
, ns
->target
, NULL
, MS_BIND
, NULL
) != 0)
197 err(EXIT_FAILURE
, _("mount %s on %s failed"), src
, ns
->target
);
203 static ino_t
get_mnt_ino(pid_t pid
)
208 snprintf(path
, sizeof(path
), "/proc/%u/ns/mnt", (unsigned) pid
);
210 if (stat(path
, &st
) != 0)
211 err(EXIT_FAILURE
, _("stat of %s failed"), path
);
215 static void settime(time_t offset
, clockid_t clk_id
)
217 char buf
[sizeof(stringify_value(ULONG_MAX
)) * 3];
220 len
= snprintf(buf
, sizeof(buf
), "%d %" PRId64
" 0", clk_id
, (int64_t) offset
);
222 fd
= open("/proc/self/timens_offsets", O_WRONLY
);
224 err(EXIT_FAILURE
, _("failed to open /proc/self/timens_offsets"));
226 if (write(fd
, buf
, len
) != len
)
227 err(EXIT_FAILURE
, _("failed to write to /proc/self/timens_offsets"));
233 * waitchild() - Wait for a process to exit successfully
234 * @pid: PID of the process to wait for
236 * Wait for a process to exit successfully. If it exits with a non-zero return
237 * code, then exit() with the same status.
239 static void waitchild(int pid
)
244 rc
= waitpid(pid
, &status
, 0);
248 err(EXIT_FAILURE
, _("waitpid failed"));
250 if (WIFEXITED(status
) &&
251 WEXITSTATUS(status
) != EXIT_SUCCESS
)
252 exit(WEXITSTATUS(status
));
257 * sync_with_child() - Tell our child we're ready and wait for it to exit
258 * @pid: The pid of our child
259 * @fd: A file descriptor created with eventfd()
261 * This tells a child created with fork_and_wait() that we are ready for it to
262 * continue. Once we have done that, wait for our child to exit.
264 static void sync_with_child(pid_t pid
, int fd
)
266 uint64_t ch
= PIPE_SYNC_BYTE
;
268 write_all(fd
, &ch
, sizeof(ch
));
275 * fork_and_wait() - Fork and wait to be sync'd with
276 * @fd - A file descriptor created with eventfd() which should be passed to
279 * This creates an eventfd and forks. The parent process returns immediately,
280 * but the child waits for a %PIPE_SYNC_BYTE on the eventfd before returning.
281 * This allows the parent to perform some tasks before the child starts its
282 * work. The parent should call sync_with_child() once it is ready for the
285 * Return: The pid from fork()
287 static pid_t
fork_and_wait(int *fd
)
294 err(EXIT_FAILURE
, _("eventfd failed"));
298 err(EXIT_FAILURE
, _("fork failed"));
301 /* wait for the our parent to tell us to continue */
302 if (read_all(*fd
, (char *)&ch
, sizeof(ch
)) != sizeof(ch
) ||
303 ch
!= PIPE_SYNC_BYTE
)
304 err(EXIT_FAILURE
, _("failed to read eventfd"));
311 static pid_t
bind_ns_files_from_child(int *fd
)
313 pid_t child
, ppid
= getpid();
314 ino_t ino
= get_mnt_ino(ppid
);
316 child
= fork_and_wait(fd
);
320 if (get_mnt_ino(ppid
) == ino
)
326 static uid_t
get_user(const char *s
, const char *err
)
332 pw
= xgetpwnam(s
, &buf
);
338 ret
= strtoul_or_err(s
, err
);
344 static gid_t
get_group(const char *s
, const char *err
)
350 gr
= xgetgrnam(s
, &buf
);
356 ret
= strtoul_or_err(s
, err
);
363 * struct map_range - A range of IDs to map
364 * @outer: First ID mapped on the outside of the namespace
365 * @inner: First ID mapped on the inside of the namespace
366 * @count: Length of the inside and outside ranges
368 * A range of uids/gids to map using new[gu]idmap.
376 #define UID_BUFSIZ sizeof(stringify_value(ULONG_MAX))
379 * get_map_range() - Parse a mapping range from a string
380 * @s: A string of the format inner:outer:count or outer,inner,count
382 * Parse a string of the form inner:outer:count or outer,inner,count into
383 * a new mapping range.
385 * Return: A new &struct map_range
387 static struct map_range
*get_map_range(const char *s
)
390 struct map_range
*ret
;
392 ret
= xmalloc(sizeof(*ret
));
394 if (sscanf(s
, "%u:%u:%u%n", &ret
->inner
, &ret
->outer
, &ret
->count
,
395 &end
) >= 3 && !s
[end
])
396 return ret
; /* inner:outer:count */
398 if (sscanf(s
, "%u,%u,%u%n", &ret
->outer
, &ret
->inner
, &ret
->count
,
399 &end
) >= 3 && !s
[end
])
400 return ret
; /* outer,inner,count */
402 errx(EXIT_FAILURE
, _("invalid mapping '%s'"), s
);
406 * read_subid_range() - Look up a user's sub[gu]id range
407 * @filename: The file to look up the range from. This should be either
408 * ``/etc/subuid`` or ``/etc/subgid``.
409 * @uid: The uid of the user whose range we should look up.
411 * This finds the first subid range matching @uid in @filename.
413 static struct map_range
*read_subid_range(char *filename
, uid_t uid
)
415 char *line
= NULL
, *pwbuf
;
419 struct map_range
*map
;
421 map
= xmalloc(sizeof(*map
));
424 pw
= xgetpwuid(uid
, &pwbuf
);
426 errx(EXIT_FAILURE
, _("you (user %d) don't exist."), uid
);
428 idmap
= fopen(filename
, "r");
430 err(EXIT_FAILURE
, _("could not open '%s'"), filename
);
433 * Each line in sub[ug]idmap looks like
434 * username:subuid:count
438 while (getline(&line
, &n
, idmap
) != -1) {
441 rest
= strchr(line
, ':');
446 if (strcmp(line
, pw
->pw_name
) &&
447 strtoul(line
, NULL
, 10) != pw
->pw_uid
)
451 rest
= strchr(s
, ':');
455 map
->outer
= strtoul_or_err(s
, _("failed to parse subid map"));
458 rest
= strchr(s
, '\n');
461 map
->count
= strtoul_or_err(s
, _("failed to parse subid map"));
470 errx(EXIT_FAILURE
, _("no line matching user \"%s\" in %s"),
471 pw
->pw_name
, filename
);
475 * map_ids() - Create a new uid/gid map
476 * @idmapper: Either newuidmap or newgidmap
477 * @ppid: Pid to set the map for
478 * @outer: ID outside the namespace for a single map.
479 * @inner: ID inside the namespace for a single map. May be -1 to only use @map.
480 * @map: A range of IDs to map
482 * This creates a new uid/gid map for @ppid using @idmapper. The ID @outer in
483 * the parent (our) namespace is mapped to the ID @inner in the child (@ppid's)
484 * namespace. In addition, the range of IDs beginning at @map->outer is mapped
485 * to the range of IDs beginning at @map->inner. The tricky bit is that we
486 * cannot let these mappings overlap. We accomplish this by removing a "hole"
487 * from @map, if @outer or @inner overlap it. This may result in one less than
488 * @map->count IDs being mapped from @map. The unmapped IDs are always the
489 * topmost IDs of the mapping (either in the parent or the child namespace).
491 * Most of the time, this function will be called with @map->outer as some
492 * large ID, @map->inner as 0, and @map->count as a large number (at least
493 * 1000, but less than @map->outer). Typically, there will be no conflict with
494 * @outer. However, @inner may split the mapping for e.g. --map-current-user.
496 * This function always exec()s or errors out and does not return.
498 static void __attribute__((__noreturn__
))
499 map_ids(const char *idmapper
, int ppid
, unsigned int outer
, unsigned int inner
,
500 struct map_range
*map
)
502 /* idmapper + pid + 4 * map + NULL */
504 /* argv - idmapper - "1" - NULL */
505 char args
[12][UID_BUFSIZ
];
507 struct map_range lo
, mid
, hi
;
508 unsigned int inner_offset
, outer_offset
;
510 /* Some helper macros to reduce bookkeeping */
511 #define push_str(s) do { \
514 #define push_ul(x) do { \
515 snprintf(args[j], sizeof(args[j]), "%u", x); \
516 push_str(args[j++]); \
519 push_str(xstrdup(idmapper
));
521 if ((int)inner
== -1) {
523 * If we don't have a "single" mapping, then we can just use map
524 * directly, starting inner IDs from zero for an auto mapping
526 push_ul(map
->inner
+ 1 ? map
->inner
: 0);
531 execvp(idmapper
, argv
);
536 * Start inner IDs from zero for an auto mapping; otherwise, if the two
537 * fixed mappings overlap, remove an ID from map
539 if (map
->inner
+ 1 == 0)
541 else if ((outer
>= map
->outer
&& outer
<= map
->outer
+ map
->count
) ||
542 (inner
>= map
->inner
&& inner
<= map
->inner
+ map
->count
))
545 /* Determine where the splits between lo, mid, and hi will be */
546 outer_offset
= min(outer
> map
->outer
? outer
- map
->outer
: 0,
548 inner_offset
= min(inner
> map
->inner
? inner
- map
->inner
: 0,
552 * In the worst case, we need three mappings:
553 * From the bottom of map to either inner or outer
555 lo
.outer
= map
->outer
;
556 lo
.inner
= map
->inner
;
557 lo
.count
= min(inner_offset
, outer_offset
);
559 /* From the lower of inner or outer to the higher */
560 mid
.outer
= lo
.outer
+ lo
.count
;
561 mid
.outer
+= mid
.outer
== outer
;
562 mid
.inner
= lo
.inner
+ lo
.count
;
563 mid
.inner
+= mid
.inner
== inner
;
564 mid
.count
= abs_diff(outer_offset
, inner_offset
);
566 /* And from the higher of inner or outer to the end of the map */
567 hi
.outer
= mid
.outer
+ mid
.count
;
568 hi
.outer
+= hi
.outer
== outer
;
569 hi
.inner
= mid
.inner
+ mid
.count
;
570 hi
.inner
+= hi
.inner
== inner
;
571 hi
.count
= map
->count
- lo
.count
- mid
.count
;
576 /* new[gu]idmap doesn't like zero-length mappings, so skip them */
593 execvp(idmapper
, argv
);
598 * map_ids_from_child() - Set up a new uid/gid map
599 * @fd: The eventfd to wait on
600 * @mapuser: The user to map the current user to (or -1)
601 * @usermap: The range of UIDs to map (or %NULL)
602 * @mapgroup: The group to map the current group to (or -1)
603 * @groupmap: The range of GIDs to map (or %NULL)
605 * fork_and_wait() for our parent to call sync_with_child() on @fd. Upon
606 * recieving the go-ahead, use newuidmap and newgidmap to set the uid/gid map
607 * for our parent's PID.
609 * Return: The pid of the child.
611 static pid_t
map_ids_from_child(int *fd
, uid_t mapuser
,
612 struct map_range
*usermap
, gid_t mapgroup
,
613 struct map_range
*groupmap
)
615 pid_t child
, pid
= 0;
616 pid_t ppid
= getpid();
618 child
= fork_and_wait(fd
);
622 /* Avoid forking more than we need to */
623 if (usermap
&& groupmap
) {
626 err(EXIT_FAILURE
, _("fork failed"));
632 map_ids("newuidmap", ppid
, geteuid(), mapuser
, usermap
);
634 map_ids("newgidmap", ppid
, getegid(), mapgroup
, groupmap
);
638 static void __attribute__((__noreturn__
)) usage(void)
642 fputs(USAGE_HEADER
, out
);
643 fprintf(out
, _(" %s [options] [<program> [<argument>...]]\n"),
644 program_invocation_short_name
);
646 fputs(USAGE_SEPARATOR
, out
);
647 fputs(_("Run a program with some namespaces unshared from the parent.\n"), out
);
649 fputs(USAGE_OPTIONS
, out
);
650 fputs(_(" -m, --mount[=<file>] unshare mounts namespace\n"), out
);
651 fputs(_(" -u, --uts[=<file>] unshare UTS namespace (hostname etc)\n"), out
);
652 fputs(_(" -i, --ipc[=<file>] unshare System V IPC namespace\n"), out
);
653 fputs(_(" -n, --net[=<file>] unshare network namespace\n"), out
);
654 fputs(_(" -p, --pid[=<file>] unshare pid namespace\n"), out
);
655 fputs(_(" -U, --user[=<file>] unshare user namespace\n"), out
);
656 fputs(_(" -C, --cgroup[=<file>] unshare cgroup namespace\n"), out
);
657 fputs(_(" -T, --time[=<file>] unshare time namespace\n"), out
);
658 fputs(USAGE_SEPARATOR
, out
);
659 fputs(_(" -f, --fork fork before launching <program>\n"), out
);
660 fputs(_(" --map-user=<uid>|<name> map current user to uid (implies --user)\n"), out
);
661 fputs(_(" --map-group=<gid>|<name> map current group to gid (implies --user)\n"), out
);
662 fputs(_(" -r, --map-root-user map current user to root (implies --user)\n"), out
);
663 fputs(_(" -c, --map-current-user map current user to itself (implies --user)\n"), out
);
664 fputs(_(" --map-auto map users and groups automatically (implies --user)\n"), out
);
665 fputs(_(" --map-users=<inneruid>:<outeruid>:<count>\n"
666 " map count users from outeruid to inneruid (implies --user)\n"), out
);
667 fputs(_(" --map-groups=<innergid>:<outergid>:<count>\n"
668 " map count groups from outergid to innergid (implies --user)\n"), out
);
669 fputs(USAGE_SEPARATOR
, out
);
670 fputs(_(" --kill-child[=<signame>] when dying, kill the forked child (implies --fork)\n"
671 " defaults to SIGKILL\n"), out
);
672 fputs(_(" --mount-proc[=<dir>] mount proc filesystem first (implies --mount)\n"), out
);
673 fputs(_(" --propagation slave|shared|private|unchanged\n"
674 " modify mount propagation in mount namespace\n"), out
);
675 fputs(_(" --setgroups allow|deny control the setgroups syscall in user namespaces\n"), out
);
676 fputs(_(" --keep-caps retain capabilities granted in user namespaces\n"), out
);
677 fputs(USAGE_SEPARATOR
, out
);
678 fputs(_(" -R, --root=<dir> run the command with root directory set to <dir>\n"), out
);
679 fputs(_(" -w, --wd=<dir> change working directory to <dir>\n"), out
);
680 fputs(_(" -S, --setuid <uid> set uid in entered namespace\n"), out
);
681 fputs(_(" -G, --setgid <gid> set gid in entered namespace\n"), out
);
682 fputs(_(" --monotonic <offset> set clock monotonic offset (seconds) in time namespaces\n"), out
);
683 fputs(_(" --boottime <offset> set clock boottime offset (seconds) in time namespaces\n"), out
);
685 fputs(USAGE_SEPARATOR
, out
);
686 printf(USAGE_HELP_OPTIONS(27));
687 printf(USAGE_MAN_TAIL("unshare(1)"));
692 int main(int argc
, char *argv
[])
695 OPT_MOUNTPROC
= CHAR_MAX
+ 1,
708 static const struct option longopts
[] = {
709 { "help", no_argument
, NULL
, 'h' },
710 { "version", no_argument
, NULL
, 'V' },
712 { "mount", optional_argument
, NULL
, 'm' },
713 { "uts", optional_argument
, NULL
, 'u' },
714 { "ipc", optional_argument
, NULL
, 'i' },
715 { "net", optional_argument
, NULL
, 'n' },
716 { "pid", optional_argument
, NULL
, 'p' },
717 { "user", optional_argument
, NULL
, 'U' },
718 { "cgroup", optional_argument
, NULL
, 'C' },
719 { "time", optional_argument
, NULL
, 'T' },
721 { "fork", no_argument
, NULL
, 'f' },
722 { "kill-child", optional_argument
, NULL
, OPT_KILLCHILD
},
723 { "mount-proc", optional_argument
, NULL
, OPT_MOUNTPROC
},
724 { "map-user", required_argument
, NULL
, OPT_MAPUSER
},
725 { "map-users", required_argument
, NULL
, OPT_MAPUSERS
},
726 { "map-group", required_argument
, NULL
, OPT_MAPGROUP
},
727 { "map-groups", required_argument
, NULL
, OPT_MAPGROUPS
},
728 { "map-root-user", no_argument
, NULL
, 'r' },
729 { "map-current-user", no_argument
, NULL
, 'c' },
730 { "map-auto", no_argument
, NULL
, OPT_MAPAUTO
},
731 { "propagation", required_argument
, NULL
, OPT_PROPAGATION
},
732 { "setgroups", required_argument
, NULL
, OPT_SETGROUPS
},
733 { "keep-caps", no_argument
, NULL
, OPT_KEEPCAPS
},
734 { "setuid", required_argument
, NULL
, 'S' },
735 { "setgid", required_argument
, NULL
, 'G' },
736 { "root", required_argument
, NULL
, 'R' },
737 { "wd", required_argument
, NULL
, 'w' },
738 { "monotonic", required_argument
, NULL
, OPT_MONOTONIC
},
739 { "boottime", required_argument
, NULL
, OPT_BOOTTIME
},
743 int setgrpcmd
= SETGROUPS_NONE
;
744 int unshare_flags
= 0;
748 struct map_range
*usermap
= NULL
;
749 struct map_range
*groupmap
= NULL
;
750 int kill_child_signo
= 0; /* 0 means --kill-child was not used */
751 const char *procmnt
= NULL
;
752 const char *newroot
= NULL
;
753 const char *newdir
= NULL
;
754 pid_t pid_bind
= 0, pid_idmap
= 0;
757 int fd_parent_pid
= -1;
759 int fd_idmap
, fd_bind
= -1;
760 sigset_t sigset
, oldsigset
;
762 unsigned long propagation
= UNSHARE_PROPAGATION_DEFAULT
;
763 int force_uid
= 0, force_gid
= 0;
764 uid_t uid
= 0, real_euid
= geteuid();
765 gid_t gid
= 0, real_egid
= getegid();
767 time_t monotonic
= 0;
769 int force_monotonic
= 0;
770 int force_boottime
= 0;
772 setlocale(LC_ALL
, "");
773 bindtextdomain(PACKAGE
, LOCALEDIR
);
775 close_stdout_atexit();
777 while ((c
= getopt_long(argc
, argv
, "+fhVmuinpCTUrR:w:S:G:c", longopts
, NULL
)) != -1) {
783 unshare_flags
|= CLONE_NEWNS
;
785 set_ns_target(CLONE_NEWNS
, optarg
);
788 unshare_flags
|= CLONE_NEWUTS
;
790 set_ns_target(CLONE_NEWUTS
, optarg
);
793 unshare_flags
|= CLONE_NEWIPC
;
795 set_ns_target(CLONE_NEWIPC
, optarg
);
798 unshare_flags
|= CLONE_NEWNET
;
800 set_ns_target(CLONE_NEWNET
, optarg
);
803 unshare_flags
|= CLONE_NEWPID
;
805 set_ns_target(CLONE_NEWPID
, optarg
);
808 unshare_flags
|= CLONE_NEWUSER
;
810 set_ns_target(CLONE_NEWUSER
, optarg
);
813 unshare_flags
|= CLONE_NEWCGROUP
;
815 set_ns_target(CLONE_NEWCGROUP
, optarg
);
818 unshare_flags
|= CLONE_NEWTIME
;
820 set_ns_target(CLONE_NEWTIME
, optarg
);
823 unshare_flags
|= CLONE_NEWNS
;
824 procmnt
= optarg
? optarg
: "/proc";
827 unshare_flags
|= CLONE_NEWUSER
;
828 mapuser
= get_user(optarg
, _("failed to parse uid"));
831 unshare_flags
|= CLONE_NEWUSER
;
832 mapgroup
= get_group(optarg
, _("failed to parse gid"));
835 unshare_flags
|= CLONE_NEWUSER
;
840 unshare_flags
|= CLONE_NEWUSER
;
842 mapgroup
= real_egid
;
845 unshare_flags
|= CLONE_NEWUSER
;
846 if (!strcmp(optarg
, "auto"))
847 usermap
= read_subid_range(_PATH_SUBUID
, real_euid
);
849 usermap
= get_map_range(optarg
);
852 unshare_flags
|= CLONE_NEWUSER
;
853 if (!strcmp(optarg
, "auto"))
854 groupmap
= read_subid_range(_PATH_SUBGID
, real_euid
);
856 groupmap
= get_map_range(optarg
);
859 unshare_flags
|= CLONE_NEWUSER
;
860 usermap
= read_subid_range(_PATH_SUBUID
, real_euid
);
861 groupmap
= read_subid_range(_PATH_SUBGID
, real_euid
);
864 setgrpcmd
= setgroups_str2id(optarg
);
866 case OPT_PROPAGATION
:
867 propagation
= parse_propagation(optarg
);
872 if ((kill_child_signo
= signame_to_signum(optarg
)) < 0)
873 errx(EXIT_FAILURE
, _("unknown signal: %s"),
876 kill_child_signo
= SIGKILL
;
881 cap_last_cap(); /* Force last cap to be cached before we fork. */
884 uid
= strtoul_or_err(optarg
, _("failed to parse uid"));
888 gid
= strtoul_or_err(optarg
, _("failed to parse gid"));
898 monotonic
= strtoul_or_err(optarg
, _("failed to parse monotonic offset"));
902 boottime
= strtoul_or_err(optarg
, _("failed to parse boottime offset"));
909 print_version(EXIT_SUCCESS
);
911 errtryhelp(EXIT_FAILURE
);
915 if ((force_monotonic
|| force_boottime
) && !(unshare_flags
& CLONE_NEWTIME
))
916 errx(EXIT_FAILURE
, _("options --monotonic and --boottime require "
917 "unsharing of a time namespace (-t)"));
919 /* clear any inherited settings */
920 signal(SIGCHLD
, SIG_DFL
);
922 if (npersists
&& (unshare_flags
& CLONE_NEWNS
))
923 pid_bind
= bind_ns_files_from_child(&fd_bind
);
925 if (usermap
|| groupmap
)
926 pid_idmap
= map_ids_from_child(&fd_idmap
, mapuser
, usermap
,
929 if (-1 == unshare(unshare_flags
))
930 err(EXIT_FAILURE
, _("unshare failed"));
932 /* Tell child we've called unshare() */
933 if (usermap
|| groupmap
)
934 sync_with_child(pid_idmap
, fd_idmap
);
937 settime(boottime
, CLOCK_BOOTTIME
);
940 settime(monotonic
, CLOCK_MONOTONIC
);
943 if (sigemptyset(&sigset
) != 0 ||
944 sigaddset(&sigset
, SIGINT
) != 0 ||
945 sigaddset(&sigset
, SIGTERM
) != 0 ||
946 sigprocmask(SIG_BLOCK
, &sigset
, &oldsigset
) != 0)
947 err(EXIT_FAILURE
, _("sigprocmask block failed"));
949 if (kill_child_signo
!= 0) {
950 /* make a connection to the original process (parent) */
951 fd_parent_pid
= pidfd_open(getpid(), 0);
952 if (0 > fd_parent_pid
)
953 err(EXIT_FAILURE
, _("pidfd_open failed"));
956 /* force child forking before mountspace binding so
957 * pid_for_children is populated */
962 err(EXIT_FAILURE
, _("fork failed"));
964 if (sigprocmask(SIG_SETMASK
, &oldsigset
, NULL
))
966 _("sigprocmask restore failed"));
967 if (npersists
&& (unshare_flags
& CLONE_NEWNS
))
970 default: /* parent */
975 if (npersists
&& (pid
|| !forkit
)) {
977 if (pid_bind
&& (unshare_flags
& CLONE_NEWNS
))
978 sync_with_child(pid_bind
, fd_bind
);
980 /* simple way, just bind */
981 bind_ns_files(getpid());
985 if (waitpid(pid
, &status
, 0) == -1)
986 err(EXIT_FAILURE
, _("waitpid failed"));
988 if (WIFEXITED(status
))
989 return WEXITSTATUS(status
);
990 if (WIFSIGNALED(status
)) {
992 /* Ensure the signal that terminated the child will
993 * also terminate the parent. */
995 int termsig
= WTERMSIG(status
);
997 if (signal(termsig
, SIG_DFL
) == SIG_ERR
||
998 sigemptyset(&sigset
) != 0 ||
999 sigaddset(&sigset
, termsig
) != 0 ||
1000 sigprocmask(SIG_UNBLOCK
, &sigset
, NULL
) != 0)
1002 _("sigprocmask unblock failed"));
1004 kill(getpid(), termsig
);
1006 err(EXIT_FAILURE
, _("child exit failed"));
1009 if (kill_child_signo
!= 0) {
1010 if (prctl(PR_SET_PDEATHSIG
, kill_child_signo
) < 0)
1011 err(EXIT_FAILURE
, "prctl failed");
1012 #ifdef UL_HAVE_PIDFD
1013 /* Use poll() to check that there is still the original parent. */
1014 if (fd_parent_pid
!= -1) {
1015 struct pollfd pollfds
[1] = {
1016 { .fd
= fd_parent_pid
, .events
= POLLIN
}
1018 int nfds
= poll(pollfds
, 1, 0);
1021 err(EXIT_FAILURE
, "poll parent pidfd failed");
1023 /* If the child was re-parented before prctl(2) was called, the
1024 * new parent will likely not be interested in the precise exit
1025 * status of the orphan.
1030 close(fd_parent_pid
);
1036 if (mapuser
!= (uid_t
) -1 && !usermap
)
1037 map_id(_PATH_PROC_UIDMAP
, mapuser
, real_euid
);
1039 /* Since Linux 3.19 unprivileged writing of /proc/self/gid_map
1040 * has been disabled unless /proc/self/setgroups is written
1041 * first to permanently disable the ability to call setgroups
1042 * in that user namespace. */
1043 if (mapgroup
!= (gid_t
) -1 && !groupmap
) {
1044 if (setgrpcmd
== SETGROUPS_ALLOW
)
1045 errx(EXIT_FAILURE
, _("options --setgroups=allow and "
1046 "--map-group are mutually exclusive"));
1047 setgroups_control(SETGROUPS_DENY
);
1048 map_id(_PATH_PROC_GIDMAP
, mapgroup
, real_egid
);
1051 if (setgrpcmd
!= SETGROUPS_NONE
)
1052 setgroups_control(setgrpcmd
);
1054 if ((unshare_flags
& CLONE_NEWNS
) && propagation
)
1055 set_propagation(propagation
);
1058 if (chroot(newroot
) != 0)
1060 _("cannot change root directory to '%s'"), newroot
);
1061 newdir
= newdir
?: "/";
1063 if (newdir
&& chdir(newdir
))
1064 err(EXIT_FAILURE
, _("cannot chdir to '%s'"), newdir
);
1067 /* When not changing root and using the default propagation flags
1068 then the recursive propagation change of root will
1069 automatically change that of an existing proc mount. */
1070 if (!newroot
&& propagation
!= (MS_PRIVATE
|MS_REC
)) {
1071 int rc
= mount("none", procmnt
, NULL
, MS_PRIVATE
|MS_REC
, NULL
);
1073 /* Custom procmnt means that proc is very likely not mounted, causing EINVAL.
1074 Ignoring the error in this specific instance is considered safe. */
1075 if(rc
!= 0 && errno
!= EINVAL
)
1076 err(EXIT_FAILURE
, _("cannot change %s filesystem propagation"), procmnt
);
1079 if (mount("proc", procmnt
, "proc", MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, NULL
) != 0)
1080 err(EXIT_FAILURE
, _("mount %s failed"), procmnt
);
1084 if (setgroups(0, NULL
) != 0) /* drop supplementary groups */
1085 err(EXIT_FAILURE
, _("setgroups failed"));
1086 if (setgid(gid
) < 0) /* change GID */
1087 err(EXIT_FAILURE
, _("setgid failed"));
1089 if (force_uid
&& setuid(uid
) < 0) /* change UID */
1090 err(EXIT_FAILURE
, _("setuid failed"));
1092 if (keepcaps
&& (unshare_flags
& CLONE_NEWUSER
))
1093 cap_permitted_to_ambient();
1095 if (optind
< argc
) {
1096 execvp(argv
[optind
], argv
+ optind
);
1097 errexec(argv
[optind
]);