From ff01d048b4c1455241c894cf7982662c9d28fd34 Mon Sep 17 00:00:00 2001 From: Lennart Poettering <lennart@poettering.net> Date: Tue, 2 Aug 2011 05:24:58 +0200 Subject: [PATCH] exec: introduce PrivateNetwork= process option to turn off network access to specific services --- TODO | 2 ++ man/systemd-nspawn.xml | 2 +- man/systemd.exec.xml | 26 ++++++++++++++++++++++---- src/dbus-execute.h | 4 +++- src/execute.c | 15 +++++++++++++-- src/execute.h | 1 + src/exit-status.c | 3 +++ src/exit-status.h | 3 ++- src/load-fragment-gperf.gperf.m4 | 1 + src/nspawn.c | 22 +++++++++++----------- 10 files changed, 59 insertions(+), 20 deletions(-) diff --git a/TODO b/TODO index eb3f6b879..7f2d5e6fa 100644 --- a/TODO +++ b/TODO @@ -19,6 +19,8 @@ Bugfixes: Features: +* hide PAM/TCPWrap options in fragment parser when compile time disabled + * make arbitrary cgroups attributes settable * when we automatically restart a service, ensure we retsart its rdeps, too. diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 490c6c2cd..6a0d21f0a 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -155,7 +155,7 @@ </varlistentry> <varlistentry> - <term><option>--no-net</option></term> + <term><option>--private-network</option></term> <listitem><para>Turn off networking in the container. This makes all network diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 99a91b3df..d28417da1 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -783,9 +783,9 @@ <term><varname>PrivateTmp=</varname></term> <listitem><para>Takes a boolean - argument. If true sets up a new - namespace for the executed processes - and mounts a private + argument. If true sets up a new file + system namespace for the executed + processes and mounts a private <filename>/tmp</filename> directory inside it, that is not shared by processes outside of the @@ -794,7 +794,25 @@ process, but makes sharing between processes via <filename>/tmp</filename> - impossible. Defaults to false.</para></listitem> + impossible. Defaults to + false.</para></listitem> + </varlistentry> + + <varlistentry> + <term><varname>PrivateNetwork=</varname></term> + + <listitem><para>Takes a boolean + argument. If true sets up a new + network namespace for the executed + processes and configures only the + loopback network device + <literal>lo</literal> inside it. No + other network devices will be + available to the executed process. + This is useful to securely turn off + network access by the executed + process. Defaults to + false.</para></listitem> </varlistentry> <varlistentry> diff --git a/src/dbus-execute.h b/src/dbus-execute.h index 49ad6cb82..2e306794f 100644 --- a/src/dbus-execute.h +++ b/src/dbus-execute.h @@ -92,7 +92,8 @@ " <property name=\"KillMode\" type=\"s\" access=\"read\"/>\n" \ " <property name=\"KillSignal\" type=\"i\" access=\"read\"/>\n" \ " <property name=\"UtmpIdentifier\" type=\"s\" access=\"read\"/>\n" \ - " <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" + " <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" \ + " <property name=\"PrivateNetwork\" type=\"b\" access=\"read\"/>\n" #define BUS_EXEC_COMMAND_INTERFACE(name) \ " <property name=\"" name "\" type=\"a(sasbttuii)\" access=\"read\"/>\n" @@ -151,6 +152,7 @@ { interface, "InaccessibleDirectories", bus_property_append_strv, "as", (context).inaccessible_dirs }, \ { interface, "MountFlags", bus_property_append_ul, "t", &(context).mount_flags }, \ { interface, "PrivateTmp", bus_property_append_bool, "b", &(context).private_tmp }, \ + { interface, "PrivateNetwork", bus_property_append_bool, "b", &(context).private_network }, \ { interface, "SameProcessGroup", bus_property_append_bool, "b", &(context).same_pgrp }, \ { interface, "KillMode", bus_execute_append_kill_mode, "s", &(context).kill_mode }, \ { interface, "KillSignal", bus_property_append_int, "i", &(context).kill_signal }, \ diff --git a/src/execute.c b/src/execute.c index 668bf9d0f..c73b0c6c0 100644 --- a/src/execute.c +++ b/src/execute.c @@ -56,6 +56,7 @@ #include "missing.h" #include "utmp-wtmp.h" #include "def.h" +#include "loopback-setup.h" /* This assumes there is a 'tty' group */ #define TTY_MODE 0620 @@ -1208,6 +1209,14 @@ int exec_spawn(ExecCommand *command, } } #endif + if (context->private_network) { + if (unshare(CLONE_NEWNET) < 0) { + r = EXIT_NETWORK; + goto fail_child; + } + + loopback_setup(); + } if (strv_length(context->read_write_dirs) > 0 || strv_length(context->read_only_dirs) > 0 || @@ -1594,13 +1603,15 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { "%sRootDirectory: %s\n" "%sNonBlocking: %s\n" "%sPrivateTmp: %s\n" - "%sControlGroupModify: %s\n", + "%sControlGroupModify: %s\n" + "%sPrivateNetwork: %s\n", prefix, c->umask, prefix, c->working_directory ? c->working_directory : "/", prefix, c->root_directory ? c->root_directory : "/", prefix, yes_no(c->non_blocking), prefix, yes_no(c->private_tmp), - prefix, yes_no(c->control_group_modify)); + prefix, yes_no(c->control_group_modify), + prefix, yes_no(c->private_network)); STRV_FOREACH(e, c->environment) fprintf(f, "%sEnvironment: %s\n", prefix, *e); diff --git a/src/execute.h b/src/execute.h index a2d907235..b376e36a7 100644 --- a/src/execute.h +++ b/src/execute.h @@ -159,6 +159,7 @@ struct ExecContext { bool cpu_sched_reset_on_fork; bool non_blocking; bool private_tmp; + bool private_network; bool control_group_modify; diff --git a/src/exit-status.c b/src/exit-status.c index 9b7c027b4..8ed1a0e36 100644 --- a/src/exit-status.c +++ b/src/exit-status.c @@ -116,6 +116,9 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) { case EXIT_PAM: return "PAM"; + + case EXIT_NETWORK: + return "NETWORK"; } } diff --git a/src/exit-status.h b/src/exit-status.h index 28f03a591..3e977b10e 100644 --- a/src/exit-status.h +++ b/src/exit-status.h @@ -64,7 +64,8 @@ typedef enum ExitStatus { EXIT_CONFIRM, EXIT_STDERR, EXIT_TCPWRAP, - EXIT_PAM + EXIT_PAM, + EXIT_NETWORK } ExitStatus; diff --git a/src/load-fragment-gperf.gperf.m4 b/src/load-fragment-gperf.gperf.m4 index e6d8de72a..650f44490 100644 --- a/src/load-fragment-gperf.gperf.m4 +++ b/src/load-fragment-gperf.gperf.m4 @@ -68,6 +68,7 @@ $1.ReadWriteDirectories, config_parse_path_strv, 0, $1.ReadOnlyDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.read_only_dirs) $1.InaccessibleDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.inaccessible_dirs) $1.PrivateTmp, config_parse_bool, 0, offsetof($1, exec_context.private_tmp) +$1.PrivateNetwork, config_parse_bool, 0, offsetof($1, exec_context.private_network) $1.MountFlags, config_parse_exec_mount_flags, 0, offsetof($1, exec_context) $1.TCPWrapName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.tcpwrap_name) $1.PAMName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.pam_name) diff --git a/src/nspawn.c b/src/nspawn.c index c97649d38..2c1144a7f 100644 --- a/src/nspawn.c +++ b/src/nspawn.c @@ -48,7 +48,7 @@ static char *arg_directory = NULL; static char *arg_user = NULL; -static bool arg_no_net = false; +static bool arg_private_network = false; static int help(void) { @@ -57,7 +57,7 @@ static int help(void) { " -h --help Show this help\n" " -D --directory=NAME Root directory for the container\n" " -u --user=USER Run the command under specified user or uid\n" - " --no-net Disable network in container\n", + " --private-network Disable network in container\n", program_invocation_short_name); return 0; @@ -66,15 +66,15 @@ static int help(void) { static int parse_argv(int argc, char *argv[]) { enum { - ARG_NO_NET = 0x100 + ARG_PRIVATE_NETWORK = 0x100 }; static const struct option options[] = { - { "help", no_argument, NULL, 'h' }, - { "directory", required_argument, NULL, 'D' }, - { "user", required_argument, NULL, 'u' }, - { "no-net", no_argument, NULL, ARG_NO_NET }, - { NULL, 0, NULL, 0 } + { "help", no_argument, NULL, 'h' }, + { "directory", required_argument, NULL, 'D' }, + { "user", required_argument, NULL, 'u' }, + { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK }, + { NULL, 0, NULL, 0 } }; int c; @@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) { break; - case ARG_NO_NET: - arg_no_net = true; + case ARG_PRIVATE_NETWORK: + arg_private_network = true; break; case '?': @@ -710,7 +710,7 @@ int main(int argc, char *argv[]) { sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1); assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0); - if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) { + if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) { log_error("clone() failed: %m"); goto finish; }