From 4133b555ba8dd38accb272d86c01898ac4b99f95 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Thu, 13 Mar 2025 21:57:54 +0900 Subject: internal/app: rename init to init0 This makes way for the new container init. Signed-off-by: Ophestra --- cmd/fpkg/main.go | 6 +- internal/app/app_nixos_test.go | 2 +- internal/app/app_pd_test.go | 4 +- internal/app/init/early.go | 18 ----- internal/app/init/main.go | 165 ----------------------------------------- internal/app/init/payload.go | 13 ---- internal/app/init0/early.go | 18 +++++ internal/app/init0/main.go | 165 +++++++++++++++++++++++++++++++++++++++++ internal/app/init0/payload.go | 13 ++++ internal/app/seal.go | 2 +- internal/app/shim/main.go | 4 +- main.go | 6 +- test/sandbox/fs.nix | 2 +- 13 files changed, 211 insertions(+), 207 deletions(-) delete mode 100644 internal/app/init/early.go delete mode 100644 internal/app/init/main.go delete mode 100644 internal/app/init/payload.go create mode 100644 internal/app/init0/early.go create mode 100644 internal/app/init0/main.go create mode 100644 internal/app/init0/payload.go diff --git a/cmd/fpkg/main.go b/cmd/fpkg/main.go index 62ad7cd8..70f42935 100644 --- a/cmd/fpkg/main.go +++ b/cmd/fpkg/main.go @@ -15,9 +15,10 @@ import ( "git.gensokyo.uk/security/fortify/helper/bwrap" "git.gensokyo.uk/security/fortify/helper/seccomp" "git.gensokyo.uk/security/fortify/internal" - init0 "git.gensokyo.uk/security/fortify/internal/app/init" + "git.gensokyo.uk/security/fortify/internal/app/init0" "git.gensokyo.uk/security/fortify/internal/app/shim" "git.gensokyo.uk/security/fortify/internal/fmsg" + "git.gensokyo.uk/security/fortify/internal/sandbox" "git.gensokyo.uk/security/fortify/internal/sys" ) @@ -37,7 +38,8 @@ func init() { } func main() { - // early init argv0 check, skips root check and duplicate PR_SET_DUMPABLE + // early init path, skips root check and duplicate PR_SET_DUMPABLE + sandbox.TryArgv0() init0.TryArgv0() if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { diff --git a/internal/app/app_nixos_test.go b/internal/app/app_nixos_test.go index 7ebd32e9..683b179a 100644 --- a/internal/app/app_nixos_test.go +++ b/internal/app/app_nixos_test.go @@ -218,6 +218,6 @@ var testCasesNixos = []sealTestCase{ Bind("/tmp/fortify.1971/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket", "/run/dbus/system_bus_socket"). Tmpfs("/var/run/nscd", 8192). Bind("/run/wrappers/bin/fortify", "/.fortify/sbin/fortify"). - Symlink("fortify", "/.fortify/sbin/init"), + Symlink("fortify", "/.fortify/sbin/init0"), }, } diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go index 2a03d356..602965ce 100644 --- a/internal/app/app_pd_test.go +++ b/internal/app/app_pd_test.go @@ -158,7 +158,7 @@ var testCasesPd = []sealTestCase{ CopyBind("/etc/group", []byte("fortify:x:65534:\n")). Tmpfs("/var/run/nscd", 8192). Bind("/run/wrappers/bin/fortify", "/.fortify/sbin/fortify"). - Symlink("fortify", "/.fortify/sbin/init"), + Symlink("fortify", "/.fortify/sbin/init0"), }, { "nixos permissive defaults chromium", new(stubNixOS), @@ -389,6 +389,6 @@ var testCasesPd = []sealTestCase{ Bind("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/system_bus_socket", "/run/dbus/system_bus_socket"). Tmpfs("/var/run/nscd", 8192). Bind("/run/wrappers/bin/fortify", "/.fortify/sbin/fortify"). - Symlink("fortify", "/.fortify/sbin/init"), + Symlink("fortify", "/.fortify/sbin/init0"), }, } diff --git a/internal/app/init/early.go b/internal/app/init/early.go deleted file mode 100644 index ac2fedbf..00000000 --- a/internal/app/init/early.go +++ /dev/null @@ -1,18 +0,0 @@ -package init0 - -import ( - "os" - "path" - - "git.gensokyo.uk/security/fortify/internal" -) - -// used by the parent process - -// TryArgv0 calls [Main] if argv0 indicates the process is started from a file named "init". -func TryArgv0() { - if len(os.Args) > 0 && path.Base(os.Args[0]) == "init" { - Main() - internal.Exit(0) - } -} diff --git a/internal/app/init/main.go b/internal/app/init/main.go deleted file mode 100644 index 6fa22939..00000000 --- a/internal/app/init/main.go +++ /dev/null @@ -1,165 +0,0 @@ -package init0 - -import ( - "errors" - "log" - "os" - "os/exec" - "os/signal" - "syscall" - "time" - - "git.gensokyo.uk/security/fortify/helper/proc" - "git.gensokyo.uk/security/fortify/internal" - "git.gensokyo.uk/security/fortify/internal/fmsg" -) - -const ( - // time to wait for linger processes after death of initial process - residualProcessTimeout = 5 * time.Second -) - -// everything beyond this point runs within pid namespace -// proceed with caution! - -func Main() { - // sharing stdout with shim - // USE WITH CAUTION - fmsg.Prepare("init") - - // setting this prevents ptrace - if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { - log.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err) - } - - if os.Getpid() != 1 { - log.Fatal("this process must run as pid 1") - } - - // receive setup payload - var ( - payload Payload - closeSetup func() error - ) - if f, err := proc.Receive(Env, &payload, nil); err != nil { - if errors.Is(err, proc.ErrInvalid) { - log.Fatal("invalid config descriptor") - } - if errors.Is(err, proc.ErrNotSet) { - log.Fatal("FORTIFY_INIT not set") - } - - log.Fatalf("cannot decode init setup payload: %v", err) - } else { - fmsg.Store(payload.Verbose) - closeSetup = f - - // child does not need to see this - if err = os.Unsetenv(Env); err != nil { - log.Printf("cannot unset %s: %v", Env, err) - // not fatal - } else { - fmsg.Verbose("received configuration") - } - } - - // die with parent - if err := internal.SetPdeathsig(syscall.SIGKILL); err != nil { - log.Fatalf("prctl(PR_SET_PDEATHSIG, SIGKILL): %v", err) - } - - cmd := exec.Command(payload.Argv0) - cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr - cmd.Args = payload.Argv - cmd.Env = os.Environ() - - if err := cmd.Start(); err != nil { - log.Fatalf("cannot start %q: %v", payload.Argv0, err) - } - fmsg.Suspend() - - // close setup pipe as setup is now complete - if err := closeSetup(); err != nil { - log.Println("cannot close setup pipe:", err) - // not fatal - } - - sig := make(chan os.Signal, 2) - signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM) - - type winfo struct { - wpid int - wstatus syscall.WaitStatus - } - info := make(chan winfo, 1) - done := make(chan struct{}) - - go func() { - var ( - err error - wpid = -2 - wstatus syscall.WaitStatus - ) - - // keep going until no child process is left - for wpid != -1 { - if err != nil { - break - } - - if wpid != -2 { - info <- winfo{wpid, wstatus} - } - - err = syscall.EINTR - for errors.Is(err, syscall.EINTR) { - wpid, err = syscall.Wait4(-1, &wstatus, 0, nil) - } - } - if !errors.Is(err, syscall.ECHILD) { - log.Println("unexpected wait4 response:", err) - } - - close(done) - }() - - // closed after residualProcessTimeout has elapsed after initial process death - timeout := make(chan struct{}) - - r := 2 - for { - select { - case s := <-sig: - if fmsg.Resume() { - fmsg.Verbosef("terminating on %s after process start", s.String()) - } else { - fmsg.Verbosef("terminating on %s", s.String()) - } - internal.Exit(0) - case w := <-info: - if w.wpid == cmd.Process.Pid { - // initial process exited, output is most likely available again - fmsg.Resume() - - switch { - case w.wstatus.Exited(): - r = w.wstatus.ExitStatus() - case w.wstatus.Signaled(): - r = 128 + int(w.wstatus.Signal()) - default: - r = 255 - } - - go func() { - time.Sleep(residualProcessTimeout) - close(timeout) - }() - } - case <-done: - internal.Exit(r) - case <-timeout: - log.Println("timeout exceeded waiting for lingering processes") - internal.Exit(r) - } - } -} diff --git a/internal/app/init/payload.go b/internal/app/init/payload.go deleted file mode 100644 index d1dc9ec3..00000000 --- a/internal/app/init/payload.go +++ /dev/null @@ -1,13 +0,0 @@ -package init0 - -const Env = "FORTIFY_INIT" - -type Payload struct { - // target full exec path - Argv0 string - // child full argv - Argv []string - - // verbosity pass through - Verbose bool -} diff --git a/internal/app/init0/early.go b/internal/app/init0/early.go new file mode 100644 index 00000000..0bcf094c --- /dev/null +++ b/internal/app/init0/early.go @@ -0,0 +1,18 @@ +package init0 + +import ( + "os" + "path" + + "git.gensokyo.uk/security/fortify/internal" +) + +// used by the parent process + +// TryArgv0 calls [Main] if the last element of argv0 is "init0". +func TryArgv0() { + if len(os.Args) > 0 && path.Base(os.Args[0]) == "init0" { + Main() + internal.Exit(0) + } +} diff --git a/internal/app/init0/main.go b/internal/app/init0/main.go new file mode 100644 index 00000000..fe2f9aef --- /dev/null +++ b/internal/app/init0/main.go @@ -0,0 +1,165 @@ +package init0 + +import ( + "errors" + "log" + "os" + "os/exec" + "os/signal" + "syscall" + "time" + + "git.gensokyo.uk/security/fortify/helper/proc" + "git.gensokyo.uk/security/fortify/internal" + "git.gensokyo.uk/security/fortify/internal/fmsg" +) + +const ( + // time to wait for linger processes after death of initial process + residualProcessTimeout = 5 * time.Second +) + +// everything beyond this point runs within pid namespace +// proceed with caution! + +func Main() { + // sharing stdout with shim + // USE WITH CAUTION + fmsg.Prepare("init0") + + // setting this prevents ptrace + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { + log.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err) + } + + if os.Getpid() != 1 { + log.Fatal("this process must run as pid 1") + } + + // receive setup payload + var ( + payload Payload + closeSetup func() error + ) + if f, err := proc.Receive(Env, &payload, nil); err != nil { + if errors.Is(err, proc.ErrInvalid) { + log.Fatal("invalid config descriptor") + } + if errors.Is(err, proc.ErrNotSet) { + log.Fatal("FORTIFY_INIT not set") + } + + log.Fatalf("cannot decode init setup payload: %v", err) + } else { + fmsg.Store(payload.Verbose) + closeSetup = f + + // child does not need to see this + if err = os.Unsetenv(Env); err != nil { + log.Printf("cannot unset %s: %v", Env, err) + // not fatal + } else { + fmsg.Verbose("received configuration") + } + } + + // die with parent + if err := internal.SetPdeathsig(syscall.SIGKILL); err != nil { + log.Fatalf("prctl(PR_SET_PDEATHSIG, SIGKILL): %v", err) + } + + cmd := exec.Command(payload.Argv0) + cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr + cmd.Args = payload.Argv + cmd.Env = os.Environ() + + if err := cmd.Start(); err != nil { + log.Fatalf("cannot start %q: %v", payload.Argv0, err) + } + fmsg.Suspend() + + // close setup pipe as setup is now complete + if err := closeSetup(); err != nil { + log.Println("cannot close setup pipe:", err) + // not fatal + } + + sig := make(chan os.Signal, 2) + signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM) + + type winfo struct { + wpid int + wstatus syscall.WaitStatus + } + info := make(chan winfo, 1) + done := make(chan struct{}) + + go func() { + var ( + err error + wpid = -2 + wstatus syscall.WaitStatus + ) + + // keep going until no child process is left + for wpid != -1 { + if err != nil { + break + } + + if wpid != -2 { + info <- winfo{wpid, wstatus} + } + + err = syscall.EINTR + for errors.Is(err, syscall.EINTR) { + wpid, err = syscall.Wait4(-1, &wstatus, 0, nil) + } + } + if !errors.Is(err, syscall.ECHILD) { + log.Println("unexpected wait4 response:", err) + } + + close(done) + }() + + // closed after residualProcessTimeout has elapsed after initial process death + timeout := make(chan struct{}) + + r := 2 + for { + select { + case s := <-sig: + if fmsg.Resume() { + fmsg.Verbosef("terminating on %s after process start", s.String()) + } else { + fmsg.Verbosef("terminating on %s", s.String()) + } + internal.Exit(0) + case w := <-info: + if w.wpid == cmd.Process.Pid { + // initial process exited, output is most likely available again + fmsg.Resume() + + switch { + case w.wstatus.Exited(): + r = w.wstatus.ExitStatus() + case w.wstatus.Signaled(): + r = 128 + int(w.wstatus.Signal()) + default: + r = 255 + } + + go func() { + time.Sleep(residualProcessTimeout) + close(timeout) + }() + } + case <-done: + internal.Exit(r) + case <-timeout: + log.Println("timeout exceeded waiting for lingering processes") + internal.Exit(r) + } + } +} diff --git a/internal/app/init0/payload.go b/internal/app/init0/payload.go new file mode 100644 index 00000000..d1dc9ec3 --- /dev/null +++ b/internal/app/init0/payload.go @@ -0,0 +1,13 @@ +package init0 + +const Env = "FORTIFY_INIT" + +type Payload struct { + // target full exec path + Argv0 string + // child full argv + Argv []string + + // verbosity pass through + Verbose bool +} diff --git a/internal/app/seal.go b/internal/app/seal.go index b133b466..7c4ba4b7 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -486,7 +486,7 @@ func (seal *outcome) finalise(sys sys.State, config *fst.Config) error { // mount fortify in sandbox for init seal.container.Bind(sys.MustExecutable(), path.Join(fst.Tmp, "sbin/fortify")) - seal.container.Symlink("fortify", path.Join(fst.Tmp, "sbin/init")) + seal.container.Symlink("fortify", path.Join(fst.Tmp, "sbin/init0")) fmsg.Verbosef("created application seal for uid %s (%s) groups: %v, command: %s", seal.user.uid, seal.user.username, config.Confinement.Groups, config.Command) diff --git a/internal/app/shim/main.go b/internal/app/shim/main.go index ed1cb980..360c89b7 100644 --- a/internal/app/shim/main.go +++ b/internal/app/shim/main.go @@ -16,7 +16,7 @@ import ( "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/helper/seccomp" "git.gensokyo.uk/security/fortify/internal" - init0 "git.gensokyo.uk/security/fortify/internal/app/init" + "git.gensokyo.uk/security/fortify/internal/app/init0" "git.gensokyo.uk/security/fortify/internal/fmsg" ) @@ -125,7 +125,7 @@ func Main() { seccomp.CPrintln = log.Println } if b, err := helper.NewBwrap( - conf, path.Join(fst.Tmp, "sbin/init"), false, + conf, path.Join(fst.Tmp, "sbin/init0"), false, nil, func(int, int) []string { return make([]string, 0) }, extraFiles, syncFd, diff --git a/main.go b/main.go index d4fc3d93..ecf5bc79 100644 --- a/main.go +++ b/main.go @@ -21,9 +21,10 @@ import ( "git.gensokyo.uk/security/fortify/helper/seccomp" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/app" - init0 "git.gensokyo.uk/security/fortify/internal/app/init" + "git.gensokyo.uk/security/fortify/internal/app/init0" "git.gensokyo.uk/security/fortify/internal/app/shim" "git.gensokyo.uk/security/fortify/internal/fmsg" + "git.gensokyo.uk/security/fortify/internal/sandbox" "git.gensokyo.uk/security/fortify/internal/state" "git.gensokyo.uk/security/fortify/internal/sys" "git.gensokyo.uk/security/fortify/system" @@ -41,7 +42,8 @@ func init() { fmsg.Prepare("fortify") } var std sys.State = new(sys.Std) func main() { - // early init argv0 check, skips root check and duplicate PR_SET_DUMPABLE + // early init path, skips root check and duplicate PR_SET_DUMPABLE + sandbox.TryArgv0() init0.TryArgv0() if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { diff --git a/test/sandbox/fs.nix b/test/sandbox/fs.nix index 0673c618..8f2ea50f 100644 --- a/test/sandbox/fs.nix +++ b/test/sandbox/fs.nix @@ -21,7 +21,7 @@ let etc = fs "800001ed" null null; sbin = fs "800001c0" { fortify = fs "16d" null null; - init = fs "80001ff" null null; + init0 = fs "80001ff" null null; } null; host-mounts = fs "124" null null; } null; -- cgit v1.3.1