technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Isolation: mounting of procfs by default when using "rootfs".

Browse Source
This commit is contained in:
Tiago Natel de Moura
2020-10-29 20:30:53 +00:00
parent 417f5d911d
commit 0390cb3a61
15 changed files with 355 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/nxt_application.c
View File

@@ -208,14 +208,14 @@ nxt_discovery_modules(nxt_task_t *task, const char *path)
mounts = module[i].mounts;
size += mounts->nelts * nxt_length("{\"src\": \"\", \"dst\": \"\", "
"\"fstype\": \"\", \"flags\": , "
"\"data\": \"\"},");
"\"type\": , \"name\": \"\", "
"\"flags\": , \"data\": \"\"},");
mnt = mounts->elts;
for (j = 0; j < mounts->nelts; j++) {
size += nxt_strlen(mnt[j].src) + nxt_strlen(mnt[j].dst)
+ nxt_strlen(mnt[j].fstype) + NXT_INT_T_LEN
+ nxt_strlen(mnt[j].name) + (2 * NXT_INT_T_LEN)
+ (mnt[j].data == NULL ? 0 : nxt_strlen(mnt[j].data));
}
}
@@ -242,9 +242,10 @@ nxt_discovery_modules(nxt_task_t *task, const char *path)
for (j = 0; j < mounts->nelts; j++) {
p = nxt_sprintf(p, end,
"{\"src\": \"%s\", \"dst\": \"%s\", "
"\"fstype\": \"%s\", \"flags\": %d, "
"\"name\": \"%s\", \"type\": %d, \"flags\": %d, "
"\"data\": \"%s\"},",
mnt[j].src, mnt[j].dst, mnt[j].fstype, mnt[j].flags,
mnt[j].src, mnt[j].dst, mnt[j].name, mnt[j].type,
mnt[j].flags,
mnt[j].data == NULL ? (u_char *) "" : mnt[j].data);
}
@@ -386,11 +387,13 @@ nxt_discovery_module(nxt_task_t *task, nxt_mp_t *mp, nxt_array_t *modules,
goto fail;
}
to->fstype = nxt_cstr_dup(mp, to->fstype, from->fstype);
if (nxt_slow_path(to->fstype == NULL)) {
to->name = nxt_cstr_dup(mp, to->name, from->name);
if (nxt_slow_path(to->name == NULL)) {
goto fail;
}
to->type = from->type;
if (from->data != NULL) {
to->data = nxt_cstr_dup(mp, to->data, from->data);
if (nxt_slow_path(to->data == NULL)) {

115
src/nxt_fs.c
View File

@@ -18,15 +18,59 @@ static nxt_int_t nxt_fs_mkdir(const u_char *dir, mode_t mode);
nxt_int_t
nxt_fs_mount(nxt_task_t *task, nxt_fs_mount_t *mnt)
{
int rc;
int rc;
const char *fsname;
unsigned long flags;
rc = mount((const char *) mnt->src, (const char *) mnt->dst,
(const char *) mnt->fstype, mnt->flags, mnt->data);
flags = 0;
switch (mnt->type) {
case NXT_FS_BIND:
if (nxt_slow_path(mnt->flags != 0)) {
nxt_log(task, NXT_LOG_WARN,
"bind mount ignores additional flags");
}
fsname = "bind";
flags = MS_BIND | MS_REC;
break;
case NXT_FS_PROC:
fsname = "proc";
goto getflags;
case NXT_FS_TMP:
fsname = "tmpfs";
goto getflags;
default:
fsname = (const char *) mnt->name;
getflags:
if (mnt->flags & NXT_FS_FLAGS_NODEV) {
flags |= MS_NODEV;
}
if (mnt->flags & NXT_FS_FLAGS_NOEXEC) {
flags |= MS_NOEXEC;
}
if (mnt->flags & NXT_FS_FLAGS_NOSUID) {
flags |= MS_NOSUID;
}
if (!(mnt->flags & NXT_FS_FLAGS_NOTIME)) {
flags |= MS_RELATIME;
}
}
rc = mount((const char *) mnt->src, (const char *) mnt->dst, fsname, flags,
mnt->data);
if (nxt_slow_path(rc < 0)) {
nxt_alert(task, "mount(\"%s\", \"%s\", \"%s\", %d, \"%s\") %E",
mnt->src, mnt->dst, mnt->fstype, mnt->flags, mnt->data,
nxt_errno);
nxt_alert(task, "mount(\"%s\", \"%s\", \"%s\", %ul, \"%s\") %E",
mnt->src, mnt->dst, fsname, flags, mnt->data, nxt_errno);
return NXT_ERROR;
}
@@ -34,37 +78,66 @@ nxt_fs_mount(nxt_task_t *task, nxt_fs_mount_t *mnt)
return NXT_OK;
}
#elif (NXT_HAVE_FREEBSD_NMOUNT)
nxt_int_t
nxt_fs_mount(nxt_task_t *task, nxt_fs_mount_t *mnt)
{
int flags;
u_char *data, *p, *end;
size_t iovlen;
nxt_int_t ret;
const char *fstype;
const char *fsname;
struct iovec iov[128];
char errmsg[256];
if (nxt_strncmp(mnt->fstype, "bind", 4) == 0) {
fstype = "nullfs";
if (nxt_slow_path((mnt->flags & NXT_FS_FLAGS_NODEV) && !mnt->builtin)) {
nxt_alert(task, "nmount(2) doesn't support \"nodev\" option");
} else if (nxt_strncmp(mnt->fstype, "proc", 4) == 0) {
fstype = "procfs";
} else if (nxt_strncmp(mnt->fstype, "tmpfs", 5) == 0) {
fstype = "tmpfs";
} else {
nxt_alert(task, "mount type \"%s\" not implemented.", mnt->fstype);
return NXT_ERROR;
}
flags = 0;
switch (mnt->type) {
case NXT_FS_BIND:
fsname = "nullfs";
break;
case NXT_FS_PROC:
fsname = "procfs";
goto getflags;
case NXT_FS_TMP:
fsname = "tmpfs";
goto getflags;
default:
fsname = (const char *) mnt->name;
getflags:
if (mnt->flags & NXT_FS_FLAGS_NOEXEC) {
flags |= MNT_NOEXEC;
}
if (mnt->flags & NXT_FS_FLAGS_NOSUID) {
flags |= MNT_NOSUID;
}
if (mnt->flags & NXT_FS_FLAGS_NOTIME) {
flags |= MNT_NOATIME;
}
if (mnt->flags & NXT_FS_FLAGS_RDONLY) {
flags |= MNT_RDONLY;
}
}
iov[0].iov_base = (void *) "fstype";
iov[0].iov_len = 7;
iov[1].iov_base = (void *) fstype;
iov[1].iov_len = nxt_strlen(fstype) + 1;
iov[1].iov_base = (void *) fsname;
iov[1].iov_len = nxt_strlen(fsname) + 1;
iov[2].iov_base = (void *) "fspath";
iov[2].iov_len = 7;
iov[3].iov_base = (void *) mnt->dst;
@@ -117,7 +190,7 @@ nxt_fs_mount(nxt_task_t *task, nxt_fs_mount_t *mnt)
ret = NXT_OK;
if (nxt_slow_path(nmount(iov, iovlen, 0) < 0)) {
if (nxt_slow_path(nmount(iov, iovlen, flags) < 0)) {
nxt_alert(task, "nmount(%p, %d, 0) %s", iov, iovlen, errmsg);
ret = NXT_ERROR;
}

61
src/nxt_fs.h
View File

@@ -6,50 +6,33 @@
#define _NXT_FS_H_INCLUDED_
#ifdef MS_BIND
#define NXT_MS_BIND MS_BIND
#else
#define NXT_MS_BIND 0
#endif
typedef enum {
NXT_FS_UNKNOWN = 0,
NXT_FS_BIND,
NXT_FS_TMP,
NXT_FS_PROC,
NXT_FS_LAST,
} nxt_fs_type_t;
#ifdef MS_REC
#define NXT_MS_REC MS_BIND
#else
#define NXT_MS_REC 0
#endif
#ifdef MS_NOSUID
#define NXT_MS_NOSUID MS_NOSUID
#else
#define NXT_MS_NOSUID 0
#endif
#ifdef MS_NOEXEC
#define NXT_MS_NOEXEC MS_NOEXEC
#else
#define NXT_MS_NOEXEC 0
#endif
#ifdef MS_RELATIME
#define NXT_MS_RELATIME MS_RELATIME
#else
#define NXT_MS_RELATIME 0
#endif
#ifdef MS_NODEV
#define NXT_MS_NODEV MS_NODEV
#else
#define NXT_MS_NODEV 0
#endif
typedef enum {
NXT_FS_FLAGS_NOSUID = 1 << 0,
NXT_FS_FLAGS_NOEXEC = 1 << 1,
NXT_FS_FLAGS_NOTIME = 1 << 2,
NXT_FS_FLAGS_NODEV = 1 << 3,
NXT_FS_FLAGS_RDONLY = 1 << 4,
} nxt_fs_flags_t;
typedef struct {
u_char *src;
u_char *dst;
u_char *fstype;
nxt_int_t flags;
u_char *data;
nxt_uint_t builtin; /* 1-bit */
u_char *src;
u_char *dst;
nxt_fs_type_t type;
u_char *name;
nxt_fs_flags_t flags;
u_char *data;
nxt_uint_t builtin; /* 1-bit */
nxt_uint_t deps; /* 1-bit */
} nxt_fs_mount_t;

90
src/nxt_isolation.c
View File

@@ -87,15 +87,6 @@ nxt_isolation_main_prefork(nxt_task_t *task, nxt_process_t *process,
}
#endif
#if (NXT_HAVE_ISOLATION_ROOTFS)
if (process->isolation.rootfs != NULL) {
ret = nxt_isolation_set_mounts(task, process, &app_conf->type);
if (nxt_slow_path(ret != NXT_OK)) {
return ret;
}
}
#endif
if (cap_setid) {
ret = nxt_process_creds_set(task, process, &app_conf->user,
&app_conf->group);
@@ -126,6 +117,29 @@ nxt_isolation_main_prefork(nxt_task_t *task, nxt_process_t *process,
}
}
#if (NXT_HAVE_ISOLATION_ROOTFS)
if (process->isolation.rootfs != NULL) {
nxt_int_t has_mnt;
ret = nxt_isolation_set_mounts(task, process, &app_conf->type);
if (nxt_slow_path(ret != NXT_OK)) {
return ret;
}
has_mnt = 0;
#if (NXT_HAVE_CLONE_NEWNS)
has_mnt = nxt_is_clone_flag_set(process->isolation.clone.flags, NEWNS);
#endif
if (process->user_cred->uid == 0 && !has_mnt) {
nxt_log(task, NXT_LOG_WARN,
"setting user \"root\" with \"rootfs\" is unsafe without "
"\"mount\" namespace isolation");
}
}
#endif
#if (NXT_HAVE_CLONE_NEWUSER)
ret = nxt_isolation_vldt_creds(task, process);
if (nxt_slow_path(ret != NXT_OK)) {
@@ -568,10 +582,13 @@ nxt_isolation_set_lang_mounts(nxt_task_t *task, nxt_process_t *process,
}
mnt->src = (u_char *) "tmpfs";
mnt->fstype = (u_char *) "tmpfs";
mnt->flags = NXT_MS_NOSUID | NXT_MS_NODEV | NXT_MS_NOEXEC | NXT_MS_RELATIME;
mnt->name = (u_char *) "tmpfs";
mnt->type = NXT_FS_TMP;
mnt->flags = (NXT_FS_FLAGS_NOSUID | NXT_FS_FLAGS_NODEV
| NXT_FS_FLAGS_NOEXEC);
mnt->data = (u_char *) "size=1m,mode=777";
mnt->builtin = 1;
mnt->deps = 0;
mnt->dst = nxt_mp_nget(mp, rootfs_len + nxt_length("/tmp") + 1);
if (nxt_slow_path(mnt->dst == NULL)) {
@@ -582,32 +599,27 @@ nxt_isolation_set_lang_mounts(nxt_task_t *task, nxt_process_t *process,
p = nxt_cpymem(p, "/tmp", 4);
*p = '\0';
#if (NXT_HAVE_CLONE_NEWPID) && (NXT_HAVE_CLONE_NEWNS)
if (nxt_is_clone_flag_set(process->isolation.clone.flags, NEWPID)
&& nxt_is_clone_flag_set(process->isolation.clone.flags, NEWNS))
{
mnt = nxt_array_add(mounts);
if (nxt_slow_path(mnt == NULL)) {
return NXT_ERROR;
}
mnt->fstype = (u_char *) "proc";
mnt->src = (u_char *) "proc";
mnt->dst = nxt_mp_nget(mp, rootfs_len + nxt_length("/proc") + 1);
if (nxt_slow_path(mnt->dst == NULL)) {
return NXT_ERROR;
}
p = nxt_cpymem(mnt->dst, rootfs, rootfs_len);
p = nxt_cpymem(p, "/proc", 5);
*p = '\0';
mnt->data = (u_char *) "";
mnt->flags = 0;
mnt = nxt_array_add(mounts);
if (nxt_slow_path(mnt == NULL)) {
return NXT_ERROR;
}
#endif
mnt->name = (u_char *) "proc";
mnt->type = NXT_FS_PROC;
mnt->src = (u_char *) "none";
mnt->dst = nxt_mp_nget(mp, rootfs_len + nxt_length("/proc") + 1);
if (nxt_slow_path(mnt->dst == NULL)) {
return NXT_ERROR;
}
p = nxt_cpymem(mnt->dst, rootfs, rootfs_len);
p = nxt_cpymem(p, "/proc", 5);
*p = '\0';
mnt->data = (u_char *) "";
mnt->flags = NXT_FS_FLAGS_NOEXEC | NXT_FS_FLAGS_NOSUID;
mnt->builtin = 1;
mnt->deps = 0;
qsort(mounts->elts, mounts->nelts, sizeof(nxt_fs_mount_t),
nxt_isolation_mount_compare);
@@ -661,7 +673,7 @@ nxt_isolation_unmount_all(nxt_task_t *task, nxt_process_t *process)
while (n > 0) {
n--;
if (mnt[n].builtin && !automount->language_deps) {
if (mnt[n].deps && !automount->language_deps) {
continue;
}
@@ -690,11 +702,11 @@ nxt_isolation_prepare_rootfs(nxt_task_t *task, nxt_process_t *process)
for (i = 0; i < n; i++) {
dst = mnt[i].dst;
if (mnt[i].builtin && !automount->language_deps) {
if (mnt[i].deps && !automount->language_deps) {
continue;
}
if (nxt_slow_path(nxt_memcmp(mnt[i].fstype, "bind", 4) == 0
if (nxt_slow_path(mnt[i].type == NXT_FS_BIND
&& stat((const char *) mnt[i].src, &st) != 0))
{
nxt_log(task, NXT_LOG_WARN, "host path not found: %s", mnt[i].src);

10
src/nxt_main_process.c
View File

@@ -1163,9 +1163,14 @@ static nxt_conf_map_t nxt_app_lang_mounts_map[] = {
offsetof(nxt_fs_mount_t, dst),
},
{
nxt_string("fstype"),
nxt_string("name"),
NXT_CONF_MAP_CSTRZ,
offsetof(nxt_fs_mount_t, fstype),
offsetof(nxt_fs_mount_t, name),
},
{
nxt_string("type"),
NXT_CONF_MAP_INT,
offsetof(nxt_fs_mount_t, type),
},
{
nxt_string("flags"),
@@ -1297,6 +1302,7 @@ nxt_main_port_modules_handler(nxt_task_t *task, nxt_port_recv_msg_t *msg)
}
mnt->builtin = 1;
mnt->deps = 1;
ret = nxt_conf_map_object(rt->mem_pool, value,
nxt_app_lang_mounts_map,

2
src/nxt_process.h
View File

@@ -74,7 +74,7 @@ typedef struct {
typedef struct {
uint8_t language_deps; /* 1-byte */
uint8_t language_deps; /* 1-bit */
} nxt_process_automount_t;