mirror of
https://github.com/RGBCube/serenity
synced 2025-07-27 10:37:45 +00:00
Kernel: Add support for jails
Our implementation for Jails resembles much of how FreeBSD jails are working - it's essentially only a matter of using a RefPtr in the Process class to a Jail object. Then, when we iterate over all processes in various cases, we could ensure if either the current process is in jail and therefore should be restricted what is visible in terms of PID isolation, and also to be able to expose metadata about Jails in /sys/kernel/jails node (which does not reveal anything to a process which is in jail). A lifetime model for the Jail object is currently plain simple - there's simpy no way to manually delete a Jail object once it was created. Such feature should be carefully designed to allow safe destruction of a Jail without the possibility of releasing a process which is in Jail from the actual jail. Each process which is attached into a Jail cannot leave it until the end of a Process (i.e. when finalizing a Process). All jails are kept being referenced in the JailManagement. When a last attached process is finalized, the Jail is automatically destroyed.
This commit is contained in:
parent
d69a0380e1
commit
5e062414c1
35 changed files with 609 additions and 160 deletions
|
@ -12,7 +12,7 @@ ErrorOr<FlatPtr> Process::sys$disown(ProcessID pid)
|
|||
{
|
||||
VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
|
||||
TRY(require_promise(Pledge::proc));
|
||||
auto process = Process::from_pid(pid);
|
||||
auto process = Process::from_pid_in_same_jail(pid);
|
||||
if (!process)
|
||||
return ESRCH;
|
||||
if (process->ppid() != this->pid())
|
||||
|
|
|
@ -495,6 +495,7 @@ ErrorOr<void> Process::do_exec(NonnullLockRefPtr<OpenFileDescription> main_progr
|
|||
|
||||
auto old_credentials = this->credentials();
|
||||
auto new_credentials = old_credentials;
|
||||
auto old_process_attached_jail = m_attached_jail.with([&](auto& jail) -> RefPtr<Jail> { return jail; });
|
||||
|
||||
bool executable_is_setid = false;
|
||||
|
||||
|
@ -553,6 +554,9 @@ ErrorOr<void> Process::do_exec(NonnullLockRefPtr<OpenFileDescription> main_progr
|
|||
|
||||
m_executable.with([&](auto& executable) { executable = main_program_description->custody(); });
|
||||
m_arguments = move(arguments);
|
||||
m_attached_jail.with([&](auto& jail) {
|
||||
jail = old_process_attached_jail;
|
||||
});
|
||||
m_environment = move(environment);
|
||||
|
||||
TRY(m_unveil_data.with([&](auto& unveil_data) -> ErrorOr<void> {
|
||||
|
|
|
@ -42,6 +42,26 @@ ErrorOr<FlatPtr> Process::sys$fork(RegisterState& regs)
|
|||
});
|
||||
}));
|
||||
|
||||
// Note: We take the spinlock of Process::all_instances list because we need
|
||||
// to ensure that when we take the jail spinlock of two processes that we don't
|
||||
// run into a deadlock situation because both processes compete over each other Jail's
|
||||
// spinlock. Such pattern of taking 3 spinlocks in the same order happens in
|
||||
// Process::for_each* methods.
|
||||
TRY(Process::all_instances().with([&](auto const&) -> ErrorOr<void> {
|
||||
TRY(m_attached_jail.with([&](auto& parent_jail) -> ErrorOr<void> {
|
||||
return child->m_attached_jail.with([&](auto& child_jail) -> ErrorOr<void> {
|
||||
child_jail = parent_jail;
|
||||
if (child_jail) {
|
||||
child_jail->attach_count().with([&](auto& attach_count) {
|
||||
attach_count++;
|
||||
});
|
||||
}
|
||||
return {};
|
||||
});
|
||||
}));
|
||||
return {};
|
||||
}));
|
||||
|
||||
TRY(child->m_fds.with_exclusive([&](auto& child_fds) {
|
||||
return m_fds.with_exclusive([&](auto& parent_fds) {
|
||||
return child_fds.try_clone(parent_fds);
|
||||
|
|
59
Kernel/Syscalls/jail.cpp
Normal file
59
Kernel/Syscalls/jail.cpp
Normal file
|
@ -0,0 +1,59 @@
|
|||
/*
|
||||
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-2-Clause
|
||||
*/
|
||||
|
||||
#include <AK/Userspace.h>
|
||||
#include <Kernel/Jail.h>
|
||||
#include <Kernel/JailManagement.h>
|
||||
#include <Kernel/Process.h>
|
||||
#include <Kernel/StdLib.h>
|
||||
#include <LibC/sys/ioctl_numbers.h>
|
||||
|
||||
namespace Kernel {
|
||||
|
||||
constexpr size_t jail_name_max_size = 50;
|
||||
|
||||
ErrorOr<FlatPtr> Process::sys$jail_create(Userspace<Syscall::SC_jail_create_params*> user_params)
|
||||
{
|
||||
VERIFY_NO_PROCESS_BIG_LOCK(this);
|
||||
TRY(require_promise(Pledge::jail));
|
||||
|
||||
auto params = TRY(copy_typed_from_user(user_params));
|
||||
auto jail_name = TRY(get_syscall_path_argument(params.name));
|
||||
if (jail_name->length() > jail_name_max_size)
|
||||
return ENAMETOOLONG;
|
||||
|
||||
auto jail = TRY(JailManagement::the().create_jail(move(jail_name)));
|
||||
params.index = jail->index().value();
|
||||
|
||||
TRY(copy_to_user(user_params, ¶ms));
|
||||
return 0;
|
||||
}
|
||||
|
||||
ErrorOr<FlatPtr> Process::sys$jail_attach(Userspace<Syscall::SC_jail_attach_params const*> user_params)
|
||||
{
|
||||
VERIFY_NO_PROCESS_BIG_LOCK(this);
|
||||
TRY(require_promise(Pledge::jail));
|
||||
|
||||
auto params = TRY(copy_typed_from_user(user_params));
|
||||
return m_attached_jail.with([&](auto& my_jail) -> ErrorOr<FlatPtr> {
|
||||
// Note: If we are already in a jail, don't let the process escape it even if
|
||||
// it knows there are other jails.
|
||||
// Note: To ensure the process doesn't try to maliciously enumerate all jails
|
||||
// in the system, just return EPERM before doing anything else.
|
||||
if (my_jail)
|
||||
return EPERM;
|
||||
auto jail = JailManagement::the().find_jail_by_index(static_cast<JailIndex>(params.index));
|
||||
if (!jail)
|
||||
return EINVAL;
|
||||
my_jail = *jail;
|
||||
my_jail->attach_count().with([&](auto& attach_count) {
|
||||
attach_count++;
|
||||
});
|
||||
return 0;
|
||||
});
|
||||
}
|
||||
|
||||
}
|
|
@ -42,7 +42,7 @@ ErrorOr<void> Process::do_killpg(ProcessGroupID pgrp, int signal)
|
|||
bool any_succeeded = false;
|
||||
ErrorOr<void> error;
|
||||
|
||||
Process::for_each_in_pgrp(pgrp, [&](auto& process) {
|
||||
TRY(Process::current().for_each_in_pgrp_in_same_jail(pgrp, [&](auto& process) -> ErrorOr<void> {
|
||||
group_was_empty = false;
|
||||
|
||||
ErrorOr<void> res = do_kill(process, signal);
|
||||
|
@ -50,7 +50,8 @@ ErrorOr<void> Process::do_killpg(ProcessGroupID pgrp, int signal)
|
|||
any_succeeded = true;
|
||||
else
|
||||
error = move(res);
|
||||
});
|
||||
return {};
|
||||
}));
|
||||
|
||||
if (group_was_empty)
|
||||
return ESRCH;
|
||||
|
@ -67,7 +68,7 @@ ErrorOr<void> Process::do_killall(int signal)
|
|||
ErrorOr<void> error;
|
||||
|
||||
// Send the signal to all processes we have access to for.
|
||||
Process::all_instances().for_each([&](auto& process) {
|
||||
TRY(Process::for_each_in_same_jail([&](auto& process) -> ErrorOr<void> {
|
||||
ErrorOr<void> res;
|
||||
if (process.pid() == pid())
|
||||
res = do_killself(signal);
|
||||
|
@ -78,7 +79,8 @@ ErrorOr<void> Process::do_killall(int signal)
|
|||
any_succeeded = true;
|
||||
else
|
||||
error = move(res);
|
||||
});
|
||||
return {};
|
||||
}));
|
||||
|
||||
if (any_succeeded)
|
||||
return {};
|
||||
|
@ -122,7 +124,7 @@ ErrorOr<FlatPtr> Process::sys$kill(pid_t pid_or_pgid, int signal)
|
|||
return 0;
|
||||
}
|
||||
VERIFY(pid_or_pgid >= 0);
|
||||
auto peer = Process::from_pid(pid_or_pgid);
|
||||
auto peer = Process::from_pid_in_same_jail(pid_or_pgid);
|
||||
if (!peer)
|
||||
return ESRCH;
|
||||
TRY(do_kill(*peer, signal));
|
||||
|
|
|
@ -53,15 +53,15 @@ ErrorOr<FlatPtr> Process::profiling_enable(pid_t pid, u64 event_mask)
|
|||
return ENOTSUP;
|
||||
g_profiling_all_threads = true;
|
||||
PerformanceManager::add_process_created_event(*Scheduler::colonel());
|
||||
Process::for_each([](auto& process) {
|
||||
TRY(Process::for_each_in_same_jail([](auto& process) -> ErrorOr<void> {
|
||||
PerformanceManager::add_process_created_event(process);
|
||||
return IterationDecision::Continue;
|
||||
});
|
||||
return {};
|
||||
}));
|
||||
g_profiling_event_mask = event_mask;
|
||||
return 0;
|
||||
}
|
||||
|
||||
auto process = Process::from_pid(pid);
|
||||
auto process = Process::from_pid_in_same_jail(pid);
|
||||
if (!process)
|
||||
return ESRCH;
|
||||
if (process->is_dead())
|
||||
|
@ -101,7 +101,7 @@ ErrorOr<FlatPtr> Process::sys$profiling_disable(pid_t pid)
|
|||
return 0;
|
||||
}
|
||||
|
||||
auto process = Process::from_pid(pid);
|
||||
auto process = Process::from_pid_in_same_jail(pid);
|
||||
if (!process)
|
||||
return ESRCH;
|
||||
auto credentials = this->credentials();
|
||||
|
@ -140,7 +140,7 @@ ErrorOr<FlatPtr> Process::sys$profiling_free_buffer(pid_t pid)
|
|||
return 0;
|
||||
}
|
||||
|
||||
auto process = Process::from_pid(pid);
|
||||
auto process = Process::from_pid_in_same_jail(pid);
|
||||
if (!process)
|
||||
return ESRCH;
|
||||
auto credentials = this->credentials();
|
||||
|
|
|
@ -38,7 +38,7 @@ ErrorOr<NonnullRefPtr<Thread>> Process::get_thread_from_pid_or_tid(pid_t pid_or_
|
|||
case Syscall::SchedulerParametersMode::Process: {
|
||||
auto* searched_process = this;
|
||||
if (pid_or_tid != 0)
|
||||
searched_process = Process::from_pid(pid_or_tid);
|
||||
searched_process = Process::from_pid_in_same_jail(pid_or_tid);
|
||||
|
||||
if (searched_process == nullptr)
|
||||
return ESRCH;
|
||||
|
|
|
@ -16,7 +16,7 @@ ErrorOr<FlatPtr> Process::sys$getsid(pid_t pid)
|
|||
TRY(require_promise(Pledge::stdio));
|
||||
if (pid == 0)
|
||||
return sid().value();
|
||||
auto process = Process::from_pid(pid);
|
||||
auto process = Process::from_pid_in_same_jail(pid);
|
||||
if (!process)
|
||||
return ESRCH;
|
||||
if (sid() != process->sid())
|
||||
|
@ -30,10 +30,10 @@ ErrorOr<FlatPtr> Process::sys$setsid()
|
|||
TRY(require_promise(Pledge::proc));
|
||||
InterruptDisabler disabler;
|
||||
bool found_process_with_same_pgid_as_my_pid = false;
|
||||
Process::for_each_in_pgrp(pid().value(), [&](auto&) {
|
||||
TRY(Process::for_each_in_pgrp_in_same_jail(pid().value(), [&](auto&) -> ErrorOr<void> {
|
||||
found_process_with_same_pgid_as_my_pid = true;
|
||||
return IterationDecision::Break;
|
||||
});
|
||||
return {};
|
||||
}));
|
||||
if (found_process_with_same_pgid_as_my_pid)
|
||||
return EPERM;
|
||||
// Create a new Session and a new ProcessGroup.
|
||||
|
@ -52,7 +52,7 @@ ErrorOr<FlatPtr> Process::sys$getpgid(pid_t pid)
|
|||
TRY(require_promise(Pledge::stdio));
|
||||
if (pid == 0)
|
||||
return pgid().value();
|
||||
auto process = Process::from_pid(pid);
|
||||
auto process = Process::from_pid_in_same_jail(pid);
|
||||
if (!process)
|
||||
return ESRCH;
|
||||
return process->pgid().value();
|
||||
|
@ -70,10 +70,10 @@ SessionID Process::get_sid_from_pgid(ProcessGroupID pgid)
|
|||
// FIXME: This xor sys$setsid() uses the wrong locking mechanism.
|
||||
|
||||
SessionID sid { -1 };
|
||||
Process::for_each_in_pgrp(pgid, [&](auto& process) {
|
||||
MUST(Process::current().for_each_in_pgrp_in_same_jail(pgid, [&](auto& process) -> ErrorOr<void> {
|
||||
sid = process.sid();
|
||||
return IterationDecision::Break;
|
||||
});
|
||||
return {};
|
||||
}));
|
||||
|
||||
return sid;
|
||||
}
|
||||
|
@ -87,7 +87,7 @@ ErrorOr<FlatPtr> Process::sys$setpgid(pid_t specified_pid, pid_t specified_pgid)
|
|||
// The value of the pgid argument is less than 0, or is not a value supported by the implementation.
|
||||
return EINVAL;
|
||||
}
|
||||
auto process = Process::from_pid(pid);
|
||||
auto process = Process::from_pid_in_same_jail(pid);
|
||||
if (!process)
|
||||
return ESRCH;
|
||||
if (process != this && process->ppid() != this->pid()) {
|
||||
|
|
|
@ -30,7 +30,7 @@ ErrorOr<FlatPtr> Process::sys$waitid(Userspace<Syscall::SC_waitid_params const*>
|
|||
case P_ALL:
|
||||
break;
|
||||
case P_PID: {
|
||||
auto waitee_process = Process::from_pid(params.id);
|
||||
auto waitee_process = Process::from_pid_in_same_jail(params.id);
|
||||
if (!waitee_process)
|
||||
return ECHILD;
|
||||
bool waitee_is_child = waitee_process->ppid() == Process::current().pid();
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue