cmd: shim and init into separate binaries

This change also fixes a deadlock when shim fails to connect and complete the setup.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>

4 files changed, 0 insertions, 496 deletions

diff --git a/internal/shim/main.go b/internal/shim/main.go
deleted file mode 100644
index 52a8fa9e..00000000
--- a/internal/shim/main.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package shim
-
-import (
-	"encoding/gob"
-	"errors"
-	"flag"
-	"net"
-	"os"
-	"path"
-	"strconv"
-	"syscall"
-
-	"git.ophivana.moe/security/fortify/helper"
-	"git.ophivana.moe/security/fortify/internal/fmsg"
-	init0 "git.ophivana.moe/security/fortify/internal/init"
-)
-
-// everything beyond this point runs as target user
-// proceed with caution!
-
-func doShim(socket string) {
-	fmsg.SetPrefix("shim")
-
-	// re-exec
-	if len(os.Args) > 0 && os.Args[0] != "fortify" && path.IsAbs(os.Args[0]) {
-		if err := syscall.Exec(os.Args[0], []string{"fortify", "shim"}, os.Environ()); err != nil {
-			fmsg.Println("cannot re-exec self:", err)
-			// continue anyway
-		}
-	}
-
-	// dial setup socket
-	var conn *net.UnixConn
-	if c, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: socket, Net: "unix"}); err != nil {
-		fmsg.Fatal("cannot dial setup socket:", err)
-		panic("unreachable")
-	} else {
-		conn = c
-	}
-
-	// decode payload gob stream
-	var payload Payload
-	if err := gob.NewDecoder(conn).Decode(&payload); err != nil {
-		fmsg.Fatal("cannot decode shim payload:", err)
-	} else {
-		// sharing stdout with parent
-		// USE WITH CAUTION
-		fmsg.SetVerbose(payload.Verbose)
-	}
-
-	if payload.Bwrap == nil {
-		fmsg.Fatal("bwrap config not supplied")
-	}
-
-	// receive wayland fd over socket
-	wfd := -1
-	if payload.WL {
-		if fd, err := receiveWLfd(conn); err != nil {
-			fmsg.Fatal("cannot receive wayland fd:", err)
-		} else {
-			wfd = fd
-		}
-	}
-
-	// close setup socket
-	if err := conn.Close(); err != nil {
-		fmsg.Println("cannot close setup socket:", err)
-		// not fatal
-	}
-
-	var ic init0.Payload
-
-	// resolve argv0
-	ic.Argv = payload.Argv
-	if len(ic.Argv) > 0 {
-		// looked up from $PATH by parent
-		ic.Argv0 = payload.Exec[2]
-	} else {
-		// no argv, look up shell instead
-		var ok bool
-		if ic.Argv0, ok = os.LookupEnv("SHELL"); !ok {
-			fmsg.Fatal("no command was specified and $SHELL was unset")
-		}
-
-		ic.Argv = []string{ic.Argv0}
-	}
-
-	conf := payload.Bwrap
-
-	var extraFiles []*os.File
-
-	// pass wayland fd
-	if wfd != -1 {
-		if f := os.NewFile(uintptr(wfd), "wayland"); f != nil {
-			ic.WL = 3 + len(extraFiles)
-			extraFiles = append(extraFiles, f)
-		}
-	} else {
-		ic.WL = -1
-	}
-
-	// share config pipe
-	if r, w, err := os.Pipe(); err != nil {
-		fmsg.Fatal("cannot pipe:", err)
-	} else {
-		conf.SetEnv[init0.EnvInit] = strconv.Itoa(3 + len(extraFiles))
-		extraFiles = append(extraFiles, r)
-
-		fmsg.VPrintln("transmitting config to init")
-		go func() {
-			// stream config to pipe
-			if err = gob.NewEncoder(w).Encode(&ic); err != nil {
-				fmsg.Fatal("cannot transmit init config:", err)
-			}
-		}()
-	}
-
-	helper.BubblewrapName = payload.Exec[1] // resolved bwrap path by parent
-	if b, err := helper.NewBwrap(conf, nil, payload.Exec[0], func(int, int) []string { return []string{"init"} }); err != nil {
-		fmsg.Fatal("malformed sandbox config:", err)
-	} else {
-		cmd := b.Unwrap()
-		cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
-		cmd.ExtraFiles = extraFiles
-
-		if fmsg.Verbose() {
-			fmsg.VPrintln("bwrap args:", conf.Args())
-		}
-
-		// run and pass through exit code
-		if err = b.Start(); err != nil {
-			fmsg.Fatal("cannot start target process:", err)
-		} else if err = b.Wait(); err != nil {
-			fmsg.VPrintln("wait:", err)
-		}
-		if b.Unwrap().ProcessState != nil {
-			fmsg.Exit(b.Unwrap().ProcessState.ExitCode())
-		} else {
-			fmsg.Exit(127)
-		}
-	}
-}
-
-func receiveWLfd(conn *net.UnixConn) (int, error) {
-	oob := make([]byte, syscall.CmsgSpace(4)) // single fd
-
-	if _, oobn, _, _, err := conn.ReadMsgUnix(nil, oob); err != nil {
-		return -1, err
-	} else if len(oob) != oobn {
-		return -1, errors.New("invalid message length")
-	}
-
-	var msg syscall.SocketControlMessage
-	if messages, err := syscall.ParseSocketControlMessage(oob); err != nil {
-		return -1, err
-	} else if len(messages) != 1 {
-		return -1, errors.New("unexpected message count")
-	} else {
-		msg = messages[0]
-	}
-
-	if fds, err := syscall.ParseUnixRights(&msg); err != nil {
-		return -1, err
-	} else if len(fds) != 1 {
-		return -1, errors.New("unexpected fd count")
-	} else {
-		return fds[0], nil
-	}
-}
-
-// Try runs shim and stops execution if FORTIFY_SHIM is set.
-func Try() {
-	if args := flag.Args(); len(args) == 1 && args[0] == "shim" {
-		if s, ok := os.LookupEnv(EnvShim); ok {
-			doShim(s)
-			panic("unreachable")
-		}
-	}
-}
diff --git a/internal/shim/parent.go b/internal/shim/parent.go
deleted file mode 100644
index e0696671..00000000
--- a/internal/shim/parent.go
+++ /dev/null
@@ -1,200 +0,0 @@
-package shim
-
-import (
-	"errors"
-	"net"
-	"os"
-	"os/exec"
-	"sync"
-	"sync/atomic"
-	"syscall"
-	"time"
-
-	"git.ophivana.moe/security/fortify/acl"
-	"git.ophivana.moe/security/fortify/internal/fmsg"
-)
-
-// used by the parent process
-
-type Shim struct {
-	// user switcher process
-	cmd *exec.Cmd
-	// uid of shim target user
-	uid uint32
-	// whether to check shim pid
-	checkPid bool
-	// user switcher executable path
-	executable string
-	// path to setup socket
-	socket string
-	// shim setup abort reason and completion
-	abort     chan error
-	abortErr  atomic.Pointer[error]
-	abortOnce sync.Once
-	// wayland mediation, nil if disabled
-	wl *Wayland
-	// shim setup payload
-	payload *Payload
-}
-
-func New(executable string, uid uint32, socket string, wl *Wayland, payload *Payload, checkPid bool) *Shim {
-	return &Shim{uid: uid, executable: executable, socket: socket, wl: wl, payload: payload, checkPid: checkPid}
-}
-
-func (s *Shim) String() string {
-	if s.cmd == nil {
-		return "(unused shim manager)"
-	}
-	return s.cmd.String()
-}
-
-func (s *Shim) Unwrap() *exec.Cmd {
-	return s.cmd
-}
-
-func (s *Shim) Abort(err error) {
-	s.abortOnce.Do(func() {
-		s.abortErr.Store(&err)
-		// s.abort is buffered so this will never block
-		s.abort <- err
-	})
-}
-
-func (s *Shim) AbortWait(err error) {
-	s.Abort(err)
-	<-s.abort
-}
-
-type CommandBuilder func(shimEnv string) (args []string)
-
-func (s *Shim) Start(f CommandBuilder) (*time.Time, error) {
-	var (
-		cf     chan *net.UnixConn
-		accept func()
-	)
-
-	// listen on setup socket
-	if c, a, err := s.serve(); err != nil {
-		return nil, fmsg.WrapErrorSuffix(err,
-			"cannot listen on shim setup socket:")
-	} else {
-		// accepts a connection after each call to accept
-		// connections are sent to the channel cf
-		cf, accept = c, a
-	}
-
-	// start user switcher process and save time
-	s.cmd = exec.Command(s.executable, f(EnvShim+"="+s.socket)...)
-	s.cmd.Env = []string{}
-	s.cmd.Stdin, s.cmd.Stdout, s.cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
-	s.cmd.Dir = "/"
-	fmsg.VPrintln("starting shim via user switcher:", s.cmd)
-	fmsg.Withhold() // withhold messages to stderr
-	if err := s.cmd.Start(); err != nil {
-		return nil, fmsg.WrapErrorSuffix(err,
-			"cannot start user switcher:")
-	}
-	startTime := time.Now().UTC()
-
-	// kill shim if something goes wrong and an error is returned
-	killShim := func() {
-		if err := s.cmd.Process.Signal(os.Interrupt); err != nil {
-			fmsg.Println("cannot terminate shim on faulted setup:", err)
-		}
-	}
-	defer func() { killShim() }()
-
-	accept()
-	conn := <-cf
-	if conn == nil {
-		return &startTime, fmsg.WrapErrorSuffix(*s.abortErr.Load(), "cannot accept call on setup socket:")
-	}
-
-	// authenticate against called provided uid and shim pid
-	if cred, err := peerCred(conn); err != nil {
-		return &startTime, fmsg.WrapErrorSuffix(*s.abortErr.Load(), "cannot retrieve shim credentials:")
-	} else if cred.Uid != s.uid {
-		fmsg.Printf("process %d owned by user %d tried to connect, expecting %d",
-			cred.Pid, cred.Uid, s.uid)
-		err = errors.New("compromised fortify build")
-		s.Abort(err)
-		return &startTime, err
-	} else if s.checkPid && cred.Pid != int32(s.cmd.Process.Pid) {
-		fmsg.Printf("process %d tried to connect to shim setup socket, expecting shim %d",
-			cred.Pid, s.cmd.Process.Pid)
-		err = errors.New("compromised target user")
-		s.Abort(err)
-		return &startTime, err
-	}
-
-	// serve payload and wayland fd if enabled
-	// this also closes the connection
-	err := s.payload.serve(conn, s.wl)
-	if err == nil {
-		killShim = func() {}
-	}
-	s.Abort(err) // aborting with nil indicates success
-	return &startTime, err
-}
-
-func (s *Shim) serve() (chan *net.UnixConn, func(), error) {
-	if s.abort != nil {
-		panic("attempted to serve shim setup twice")
-	}
-	s.abort = make(chan error, 1)
-
-	cf := make(chan *net.UnixConn)
-	accept := make(chan struct{}, 1)
-
-	if l, err := net.ListenUnix("unix", &net.UnixAddr{Name: s.socket, Net: "unix"}); err != nil {
-		return nil, nil, err
-	} else {
-		l.SetUnlinkOnClose(true)
-
-		fmsg.VPrintf("listening on shim setup socket %q", s.socket)
-		if err = acl.UpdatePerm(s.socket, int(s.uid), acl.Read, acl.Write, acl.Execute); err != nil {
-			fmsg.Println("cannot append ACL entry to shim setup socket:", err)
-			s.Abort(err) // ensures setup socket cleanup
-		}
-
-		go func() {
-			for {
-				select {
-				case err = <-s.abort:
-					if err != nil {
-						fmsg.VPrintln("aborting shim setup, reason:", err)
-					}
-					if err = l.Close(); err != nil {
-						fmsg.Println("cannot close setup socket:", err)
-					}
-					close(s.abort)
-					close(cf)
-					return
-				case <-accept:
-					if conn, err0 := l.AcceptUnix(); err0 != nil {
-						s.Abort(err0) // does not block, breaks loop
-						cf <- nil     // receiver sees nil value and loads err0 stored during abort
-					} else {
-						cf <- conn
-					}
-				}
-			}
-		}()
-	}
-
-	return cf, func() { accept <- struct{}{} }, nil
-}
-
-// peerCred fetches peer credentials of conn
-func peerCred(conn *net.UnixConn) (ucred *syscall.Ucred, err error) {
-	var raw syscall.RawConn
-	if raw, err = conn.SyscallConn(); err != nil {
-		return
-	}
-
-	err0 := raw.Control(func(fd uintptr) {
-		ucred, err = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
-	})
-	err = errors.Join(err, err0)
-	return
-}
diff --git a/internal/shim/payload.go b/internal/shim/payload.go
deleted file mode 100644
index ba39ec04..00000000
--- a/internal/shim/payload.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package shim
-
-import (
-	"encoding/gob"
-	"errors"
-	"net"
-
-	"git.ophivana.moe/security/fortify/helper/bwrap"
-	"git.ophivana.moe/security/fortify/internal/fmsg"
-)
-
-const EnvShim = "FORTIFY_SHIM"
-
-type Payload struct {
-	// child full argv
-	Argv []string
-	// fortify, bwrap, target full exec path
-	Exec [3]string
-	// bwrap config
-	Bwrap *bwrap.Config
-	// whether to pass wayland fd
-	WL bool
-
-	// verbosity pass through
-	Verbose bool
-}
-
-func (p *Payload) serve(conn *net.UnixConn, wl *Wayland) error {
-	if err := gob.NewEncoder(conn).Encode(*p); err != nil {
-		return fmsg.WrapErrorSuffix(err,
-			"cannot stream shim payload:")
-	}
-
-	if wl != nil {
-		if err := wl.WriteUnix(conn); err != nil {
-			return errors.Join(err, conn.Close())
-		}
-	}
-
-	return fmsg.WrapErrorSuffix(conn.Close(),
-		"cannot close setup connection:")
-}
diff --git a/internal/shim/wayland.go b/internal/shim/wayland.go
deleted file mode 100644
index 3bac55bc..00000000
--- a/internal/shim/wayland.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package shim
-
-import (
-	"fmt"
-	"net"
-	"sync"
-	"syscall"
-
-	"git.ophivana.moe/security/fortify/internal/fmsg"
-)
-
-// Wayland implements wayland mediation.
-type Wayland struct {
-	// wayland socket path
-	Path string
-
-	// wayland connection
-	conn *net.UnixConn
-
-	connErr error
-	sync.Once
-	// wait for wayland client to exit
-	done chan struct{}
-}
-
-func (wl *Wayland) WriteUnix(conn *net.UnixConn) error {
-	// connect to host wayland socket
-	if f, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: wl.Path, Net: "unix"}); err != nil {
-		return fmsg.WrapErrorSuffix(err,
-			fmt.Sprintf("cannot connect to wayland at %q:", wl.Path))
-	} else {
-		fmsg.VPrintf("connected to wayland at %q", wl.Path)
-		wl.conn = f
-	}
-
-	// set up for passing wayland socket
-	if rc, err := wl.conn.SyscallConn(); err != nil {
-		return fmsg.WrapErrorSuffix(err, "cannot obtain raw wayland connection:")
-	} else {
-		ec := make(chan error)
-		go func() {
-			// pass wayland connection fd
-			if err = rc.Control(func(fd uintptr) {
-				if _, _, err = conn.WriteMsgUnix(nil, syscall.UnixRights(int(fd)), nil); err != nil {
-					ec <- fmsg.WrapErrorSuffix(err, "cannot pass wayland connection to shim:")
-					return
-				}
-				ec <- nil
-
-				// block until shim exits
-				<-wl.done
-				fmsg.VPrintln("releasing wayland connection")
-			}); err != nil {
-				ec <- fmsg.WrapErrorSuffix(err, "cannot obtain wayland connection fd:")
-				return
-			}
-		}()
-		return <-ec
-	}
-}
-
-func (wl *Wayland) Close() error {
-	wl.Do(func() {
-		close(wl.done)
-		wl.connErr = wl.conn.Close()
-	})
-
-	return wl.connErr
-}
-
-func NewWayland() *Wayland {
-	wl := new(Wayland)
-	wl.done = make(chan struct{})
-	return wl
-}