Skip to content

Commit

Permalink
Merge pull request #3641 from brauner/2021-01-30/fixes
Browse files Browse the repository at this point in the history 
attach: pidfd-based hardening and file-descriptor-only LSM interactions
  • Loading branch information
@stgraber
stgraber committed Jan 31, 2021
2 parents ee4aad1 + fbf281d commit 326bb02
Show file tree
Hide file tree
Showing 7 changed files with 201 additions and 95 deletions.
141 changes: 103 additions & 38 deletions src/lxc/attach.c
View file
Expand Up @@ -57,6 +57,7 @@ lxc_log_define(attach, lxc);
static lxc_attach_options_t attach_static_default_options = LXC_ATTACH_OPTIONS_DEFAULT;

struct attach_context {
unsigned int attach_flags;
int init_pid;
int dfd_init_pid;
int dfd_self_pid;
Expand All @@ -69,6 +70,49 @@ struct attach_context {
struct lsm_ops *lsm_ops;
};

static pid_t pidfd_get_pid(int pidfd)
{
__do_free char *line = NULL;
__do_fclose FILE *f = NULL;
size_t len = 0;
char path[STRLITERALLEN("/proc/self/fdinfo/") +
INTTYPE_TO_STRLEN(int) + 1 ] = "/proc/self/fdinfo/";
int ret;

if (pidfd < 0)
return -EBADF;

ret = snprintf(path + STRLITERALLEN("/proc/self/fdinfo/"),
INTTYPE_TO_STRLEN(int), "%d", pidfd);
if (ret < 0 || ret > (size_t)INTTYPE_TO_STRLEN(int))
return ret_errno(EIO);

f = fopen_cloexec(path, "re");
if (!f)
return -errno;

while (getline(&line, &len, f) != -1) {
const char *prefix = "Pid:\t";
const size_t prefix_len = STRLITERALLEN("Pid:\t");
int pid = -ESRCH;
char *slider = line;

if (strncmp(slider, prefix, prefix_len))
continue;

slider += prefix_len;
slider = lxc_trim_whitespace_in_place(slider);

ret = lxc_safe_int(slider, &pid);
if (ret)
return -ret;

return pid;
}

return ret_errno(ENOENT);
}

static inline bool sync_wake_pid(int fd, pid_t pid)
{
return lxc_write_nointr(fd, &pid, sizeof(pid_t)) == sizeof(pid_t);
Expand All @@ -89,6 +133,12 @@ static inline bool sync_wait_fd(int fd, int *fd_recv)
return lxc_abstract_unix_recv_fds(fd, fd_recv, 1, NULL, 0) > 0;
}

static bool attach_lsm(lxc_attach_options_t *options)
{
return (options->namespaces & CLONE_NEWNS) &&
(options->attach_flags & (LXC_ATTACH_LSM | LXC_ATTACH_LSM_LABEL));
}

static struct attach_context *alloc_attach_context(void)
{
struct attach_context *ctx;
Expand Down Expand Up @@ -127,19 +177,26 @@ static int get_personality(const char *name, const char *lxcpath,
}

static int get_attach_context(struct attach_context *ctx,
struct lxc_container *container)
struct lxc_container *container,
lxc_attach_options_t *options)
{
__do_close int dfd_self_pid = -EBADF, dfd_init_pid = -EBADF, fd_status = -EBADF;
__do_free char *line = NULL;
__do_close int dfd_self_pid = -EBADF, dfd_init_pid = -EBADF, fd_status = -EBADF, init_pidfd = -EBADF;
__do_free char *line = NULL, *lsm_label = NULL;
__do_fclose FILE *f_status = NULL;
int ret;
bool found;
char path[LXC_PROC_PID_LEN];
size_t line_bufsz = 0;

ctx->container = container;
ctx->attach_flags = options->attach_flags;

init_pidfd = lxc_cmd_get_init_pidfd(container->name, container->config_path);
if (init_pidfd >= 0)
ctx->init_pid = pidfd_get_pid(init_pidfd);
else
ctx->init_pid = lxc_cmd_get_init_pid(container->name, container->config_path);

ctx->init_pid = lxc_cmd_get_init_pid(container->name, container->config_path);
if (ctx->init_pid < 0)
return log_error(-1, "Failed to get init pid");

Expand All @@ -163,6 +220,14 @@ static int get_attach_context(struct attach_context *ctx,
if (fd_status < 0)
return -errno;

if (init_pidfd >= 0) {
ret = lxc_raw_pidfd_send_signal(init_pidfd, 0, NULL, 0);
if (ret)
return log_error_errno(-errno, errno, "Container process exited or PID has been recycled");
else
TRACE("Container process still running and PID was not recycled");
}

f_status = fdopen(fd_status, "re");
if (!f_status)
return log_error_errno(-errno, errno, "Failed to open file descriptor %d", fd_status);
Expand All @@ -183,8 +248,16 @@ static int get_attach_context(struct attach_context *ctx,

ctx->lsm_ops = lsm_init_static();

/* Move to file descriptor-only lsm label retrieval. */
ctx->lsm_label = ctx->lsm_ops->process_label_get(ctx->lsm_ops, ctx->init_pid);
if (attach_lsm(options)) {
if (ctx->attach_flags & LXC_ATTACH_LSM_LABEL)
lsm_label = options->lsm_label;
else
lsm_label = ctx->lsm_ops->process_label_get_at(ctx->lsm_ops, dfd_init_pid);
if (!lsm_label)
WARN("No security context received");
else
INFO("Retrieved security context %s", lsm_label);
}
ctx->ns_inherited = 0;

ret = get_personality(container->name, container->config_path, &ctx->personality);
Expand All @@ -199,6 +272,7 @@ static int get_attach_context(struct attach_context *ctx,

ctx->dfd_init_pid = move_fd(dfd_init_pid);
ctx->dfd_self_pid = move_fd(dfd_self_pid);
ctx->lsm_label = move_ptr(lsm_label);
return 0;
}

Expand Down Expand Up @@ -284,7 +358,8 @@ static inline void close_nsfds(struct attach_context *ctx)
static void put_attach_context(struct attach_context *ctx)
{
if (ctx) {
free_disarm(ctx->lsm_label);
if (!(ctx->attach_flags & LXC_ATTACH_LSM_LABEL))
free_disarm(ctx->lsm_label);
close_prot_errno_disarm(ctx->dfd_init_pid);

if (ctx->container) {
Expand Down Expand Up @@ -712,13 +787,12 @@ static bool fetch_seccomp(struct lxc_container *c, lxc_attach_options_t *options
int ret;
bool bret;

if (!(options->namespaces & CLONE_NEWNS) ||
!(options->attach_flags & LXC_ATTACH_LSM)) {
if (!attach_lsm(options)) {
free_disarm(c->lxc_conf->seccomp.seccomp);
return true;
}

/* Remove current setting. */
/* Remove current setting. */
if (!c->set_config_item(c, "lxc.seccomp.profile", "") &&
!c->set_config_item(c, "lxc.seccomp", ""))
return false;
Expand Down Expand Up @@ -774,16 +848,18 @@ struct attach_payload {

static void put_attach_payload(struct attach_payload *p)
{
close_prot_errno_disarm(p->ipc_socket);
close_prot_errno_disarm(p->terminal_pts_fd);
if (p->ctx) {
if (p) {
close_prot_errno_disarm(p->ipc_socket);
close_prot_errno_disarm(p->terminal_pts_fd);
put_attach_context(p->ctx);
p->ctx = NULL;
}
}

__noreturn static void do_attach(struct attach_payload *ap)
{
lxc_attach_exec_t attach_function = move_ptr(ap->exec_function);
void *attach_function_args = move_ptr(ap->exec_payload);
int lsm_fd, ret;
uid_t new_uid;
gid_t new_gid;
Expand All @@ -792,10 +868,6 @@ __noreturn static void do_attach(struct attach_payload *ap)
lxc_attach_options_t* options = ap->options;
struct attach_context *ctx = ap->ctx;
struct lxc_conf *conf = ctx->container->lxc_conf;
bool needs_lsm = (options->namespaces & CLONE_NEWNS) &&
(options->attach_flags & LXC_ATTACH_LSM) &&
ctx->lsm_label;
char *lsm_label = NULL;

/* A description of the purpose of this functionality is provided in the
* lxc-attach(1) manual page. We have to remount here and not in the
Expand Down Expand Up @@ -851,7 +923,8 @@ __noreturn static void do_attach(struct attach_payload *ap)

TRACE("Set up environment");

/* This remark only affects fully unprivileged containers:
/*
* This remark only affects fully unprivileged containers:
* Receive fd for LSM security module before we set{g,u}id(). The reason
* is that on set{g,u}id() the kernel will a) make us undumpable and b)
* we will change our effective uid. This means our effective uid will
Expand All @@ -862,7 +935,7 @@ __noreturn static void do_attach(struct attach_payload *ap)
* mounted with hidepid={1,2}. So let's get the lsm label fd before the
* set{g,u}id().
*/
if (needs_lsm) {
if (attach_lsm(options) && ctx->lsm_label) {
if (!sync_wait_fd(ap->ipc_socket, ATTACH_SYNC_LSM(&lsm_fd))) {
SYSERROR("Failed to receive lsm label fd");
goto on_error;
Expand Down Expand Up @@ -911,17 +984,12 @@ __noreturn static void do_attach(struct attach_payload *ap)
else
new_gid = ns_root_gid;

if (needs_lsm) {
if (attach_lsm(options) && ctx->lsm_label) {
bool on_exec;

/* Change into our new LSM profile. */
on_exec = options->attach_flags & LXC_ATTACH_LSM_EXEC ? true : false;
if (options->attach_flags & LXC_ATTACH_LSM_LABEL)
lsm_label = options->lsm_label;
if (!lsm_label)
lsm_label = ctx->lsm_label;
ret = ctx->lsm_ops->process_label_set_at(ctx->lsm_ops, lsm_fd,
lsm_label, on_exec);
ret = ctx->lsm_ops->process_label_set_at(ctx->lsm_ops, lsm_fd, ctx->lsm_label, on_exec);
close_prot_errno_disarm(lsm_fd);
if (ret < 0)
goto on_error;
Expand Down Expand Up @@ -950,10 +1018,6 @@ __noreturn static void do_attach(struct attach_payload *ap)
goto on_error;
}

close_prot_errno_disarm(ap->ipc_socket);
put_attach_context(ctx);
ap->ctx = NULL;

/* The following is done after the communication socket is shut down.
* That way, all errors that might (though unlikely) occur up until this
* point will have their messages printed to the original stderr (if
Expand Down Expand Up @@ -1007,6 +1071,8 @@ __noreturn static void do_attach(struct attach_payload *ap)
TRACE("Prepared terminal file descriptor %d", ap->terminal_pts_fd);
}

put_attach_payload(ap);

/* Avoid unnecessary syscalls. */
if (new_uid == ns_root_uid)
new_uid = LXC_INVALID_UID;
Expand All @@ -1023,10 +1089,9 @@ __noreturn static void do_attach(struct attach_payload *ap)
goto on_error;

/* We're done, so we can now do whatever the user intended us to do. */
_exit(ap->exec_function(ap->exec_payload));
_exit(attach_function(attach_function_args));

on_error:
put_attach_payload(ap);
ERROR("Failed to attach to container");
_exit(EXIT_FAILURE);
}
Expand Down Expand Up @@ -1106,16 +1171,18 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
name = container->name;
lxcpath = container->config_path;

if (!options)
if (!options) {
options = &attach_static_default_options;
options->lsm_label = NULL;
}

ctx = alloc_attach_context();
if (!ctx) {
lxc_container_put(container);
return log_error_errno(-ENOMEM, ENOMEM, "Failed to allocate attach context");
}

ret = get_attach_context(ctx, container);
ret = get_attach_context(ctx, container, options);
if (ret) {
put_attach_context(ctx);
return log_error(-1, "Failed to get attach context");
Expand Down Expand Up @@ -1419,14 +1486,12 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
to_cleanup_pid = attached_pid;

/* Open LSM fd and send it to child. */
if ((options->namespaces & CLONE_NEWNS) &&
(options->attach_flags & LXC_ATTACH_LSM) && ctx->lsm_label) {
if (attach_lsm(options) && ctx->lsm_label) {
__do_close int labelfd = -EBADF;
bool on_exec;

on_exec = options->attach_flags & LXC_ATTACH_LSM_EXEC ? true : false;
labelfd = ctx->lsm_ops->process_label_fd_get(ctx->lsm_ops,
attached_pid, on_exec);
labelfd = ctx->lsm_ops->process_label_fd_get(ctx->lsm_ops, attached_pid, on_exec);
if (labelfd < 0)
goto close_mainloop;

Expand Down
1 change: 1 addition & 0 deletions src/lxc/attach_options.h
View file
Expand Up @@ -135,6 +135,7 @@ typedef struct lxc_attach_options_t {
/* .stdout_fd = */ 1, \
/* .stderr_fd = */ 2, \
/* .log_fd = */ -EBADF, \
/* .lsm_label = */ NULL, \
}

/*!
Expand Down
54 changes: 27 additions & 27 deletions src/lxc/cgroups/cgfsng.c
View file
Expand Up @@ -3454,33 +3454,33 @@ struct cgroup_ops *cgfsng_ops_init(struct lxc_conf *conf)
if (cg_init(cgfsng_ops, conf))
return NULL;

cgfsng_ops->data_init = cgfsng_data_init;
cgfsng_ops->payload_destroy = cgfsng_payload_destroy;
cgfsng_ops->monitor_destroy = cgfsng_monitor_destroy;
cgfsng_ops->monitor_create = cgfsng_monitor_create;
cgfsng_ops->monitor_enter = cgfsng_monitor_enter;
cgfsng_ops->monitor_delegate_controllers = cgfsng_monitor_delegate_controllers;
cgfsng_ops->payload_delegate_controllers = cgfsng_payload_delegate_controllers;
cgfsng_ops->payload_create = cgfsng_payload_create;
cgfsng_ops->payload_enter = cgfsng_payload_enter;
cgfsng_ops->payload_finalize = cgfsng_payload_finalize;
cgfsng_ops->escape = cgfsng_escape;
cgfsng_ops->num_hierarchies = cgfsng_num_hierarchies;
cgfsng_ops->get_hierarchies = cgfsng_get_hierarchies;
cgfsng_ops->get_cgroup = cgfsng_get_cgroup;
cgfsng_ops->get = cgfsng_get;
cgfsng_ops->set = cgfsng_set;
cgfsng_ops->freeze = cgfsng_freeze;
cgfsng_ops->unfreeze = cgfsng_unfreeze;
cgfsng_ops->setup_limits_legacy = cgfsng_setup_limits_legacy;
cgfsng_ops->setup_limits = cgfsng_setup_limits;
cgfsng_ops->driver = "cgfsng";
cgfsng_ops->version = "1.0.0";
cgfsng_ops->attach = cgfsng_attach;
cgfsng_ops->chown = cgfsng_chown;
cgfsng_ops->mount = cgfsng_mount;
cgfsng_ops->devices_activate = cgfsng_devices_activate;
cgfsng_ops->get_limiting_cgroup = cgfsng_get_limiting_cgroup;
cgfsng_ops->data_init = cgfsng_data_init;
cgfsng_ops->payload_destroy = cgfsng_payload_destroy;
cgfsng_ops->monitor_destroy = cgfsng_monitor_destroy;
cgfsng_ops->monitor_create = cgfsng_monitor_create;
cgfsng_ops->monitor_enter = cgfsng_monitor_enter;
cgfsng_ops->monitor_delegate_controllers = cgfsng_monitor_delegate_controllers;
cgfsng_ops->payload_delegate_controllers = cgfsng_payload_delegate_controllers;
cgfsng_ops->payload_create = cgfsng_payload_create;
cgfsng_ops->payload_enter = cgfsng_payload_enter;
cgfsng_ops->payload_finalize = cgfsng_payload_finalize;
cgfsng_ops->escape = cgfsng_escape;
cgfsng_ops->num_hierarchies = cgfsng_num_hierarchies;
cgfsng_ops->get_hierarchies = cgfsng_get_hierarchies;
cgfsng_ops->get_cgroup = cgfsng_get_cgroup;
cgfsng_ops->get = cgfsng_get;
cgfsng_ops->set = cgfsng_set;
cgfsng_ops->freeze = cgfsng_freeze;
cgfsng_ops->unfreeze = cgfsng_unfreeze;
cgfsng_ops->setup_limits_legacy = cgfsng_setup_limits_legacy;
cgfsng_ops->setup_limits = cgfsng_setup_limits;
cgfsng_ops->driver = "cgfsng";
cgfsng_ops->version = "1.0.0";
cgfsng_ops->attach = cgfsng_attach;
cgfsng_ops->chown = cgfsng_chown;
cgfsng_ops->mount = cgfsng_mount;
cgfsng_ops->devices_activate = cgfsng_devices_activate;
cgfsng_ops->get_limiting_cgroup = cgfsng_get_limiting_cgroup;

return move_ptr(cgfsng_ops);
}

0 comments on commit 326bb02

Please sign in to comment.