cage.c

/* 
 * cage - makes a nice padded cell for untrusted applications.
 *
 * Copyright (C) 2001 Anthony D. Urso
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  
 *
 * $Id: cage.c,v 1.8 2001/11/19 08:08:45 anthonyu Exp $
 *
 */


#include <errno.h>
#include <fcntl.h>
#include <getopt.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "config.h"


#ifdef HAVE_LIBCAP
#  include <sys/capability.h>
#else
/* Thanks to Vadasz Laszlo for correcting this: */
#  include <linux/capability.h>
#  include <linux/unistd.h>
_syscall2(int, capget, cap_user_header_t, header, cap_user_data_t, data)
_syscall2(int, capset, cap_user_header_t, header, const cap_user_data_t, data)
#endif /* HAVE_LIBCAP */


static int decode_switches(int, char **);
static void die(char *);
static void usage(int);

#ifdef HAVE_LIBCAP
char *captxt;
#endif
uid_t uid, gid;


static int decode_switches(int argc, char *argv[])
{

	struct option long_options[] = {
#ifdef HAVE_LIBCAP
		{"caps", required_argument, 0, 'c'},
#endif
		{"uid", required_argument, 0, 'u'},
		{"gid", required_argument, 0, 'g'},
#if 0
		{"euid", required_argument, 0, 'U'},
		{"egid", required_argument, 0, 'G'},
#endif
		{"help", no_argument, 0, 'h'},
		{"version", no_argument, 0, 'v'},
		{NULL, 0, NULL, 0}
	};

	int c;
	unsigned long tmp;


	while ((c = getopt_long(argc, argv,
#ifdef HAVE_LIBCAP
				"c:"	/* caps to run under */
#endif
				"u:"	/* uid to run under */
				"g:"	/* gid to run under */
#if 0
				"U:"	/* euid to run under */
				"G:"	/* egid to run under */
#endif
				"h"	/* help */
				"v",	/* version */
				long_options,
				NULL)) != EOF) {
		switch(c) {
#ifdef HAVE_LIBCAP
			case 'c':
				if ((captxt = strdup(optarg)) == NULL)
					die("strdup");
				break;
#endif
			case 'u':
				tmp = strtoul(optarg, NULL, 0);
				uid = (tmp > 65535) ? 0 : (unsigned short)tmp;
				if (!uid)
					usage(-1);
				break;
			case 'g':
				tmp = strtoul(optarg, NULL, 0);
				gid = (tmp > 65535) ? 0 : (unsigned short)tmp;
				if (!gid)
					usage(-1);
				break;
#if 0
			case 'U':
				tmp = strtoul(optarg, NULL, 0);
				euid = (tmp > 65535) ? 0 : (unsigned short)tmp;
				if (!euid)
					usage(-1);
				break;
			case 'G':
				tmp = strtoul(optarg, NULL, 0);
				egid = (tmp > 65535) ? 0 : (unsigned short)tmp;
				if (!egid)
					usage(-1);
				break;
#endif
			case 'v':
				printf("cage %s\n", VERSION);
				exit(EXIT_SUCCESS);
			case 'h':
				usage(EXIT_SUCCESS);
			default:
				usage(EXIT_FAILURE);
		}
	}

	return optind;

}


static void die(char *errmsg)
{

	if (errno) {
		perror(errmsg);
		exit(errno);
	} else {
		fprintf(stderr, "%s", errmsg);
		exit(EXIT_FAILURE);
	}

}


static void usage(int status)
{

#ifdef HAVE_LIBCAP
	fprintf(stderr, "Usage: cage [-ug id] [-c <caps>] newroot command [args...]\n\n");
	fprintf(stderr, "\t-c, --caps\t\tcaps to use, instead of default\n");	
#else
	fprintf(stderr, "Usage: cage [-ug id] newroot command [args...]\n\n");
#endif
	fprintf(stderr, "\t-u, --uid\t\tuid to run under\n");	
	fprintf(stderr, "\t-g, --gid\t\tgid to run under\n");	
#if 0
	fprintf(stderr, "\t-U, --euid\t\teuid to run under\n");	
	fprintf(stderr, "\t-G, --egid\t\tegid to run under\n");	
#endif
	fprintf(stderr, "\t-h, --help\t\tdisplay this help and exit\n");
	fprintf(stderr, "\t-v, --version\t\toutput version and exit\n\n");
	
	exit(status);

}


int main(int argc, char *argv[])
{

	int num;
	char *dir, **cmd;

#ifdef HAVE_LIBCAP
	cap_t caps;
	cap_value_t capv[7];
	int flags;
#else
	cap_user_header_t head;
	cap_user_data_t data;
	__u32 mask;
#endif


	uid = 0;
	gid = 0;
#if 0
	euid = geteuid();
	egid = getegid();
#endif

	num = decode_switches(argc, argv);

	dir = argv[num++];
	cmd = argv + num;

	if (dir == NULL)
		usage(EXIT_FAILURE);

	if (chdir(dir))
		die(dir);

	if (chroot(dir))
		die("chroot");

#ifdef HAVE_LIBCAP
	if (captxt != NULL) {
		if ((caps = cap_from_text(captxt)) == NULL)
		       die("cap_from_text");
	} else {
		if ((caps = cap_get_proc()) == NULL)
			die("cap_get_proc");
 
		capv[0] = CAP_SETPCAP;	  /* give caps to non-chrooted tasks */
		capv[1] = CAP_SYS_MODULE; /* hijack syscalls like chroot() */
		capv[2] = CAP_SYS_RAWIO;  /* raw disk access (needed?) */
		capv[3] = CAP_SYS_CHROOT; /* can't have this, obviously... */
		capv[4] = CAP_SYS_PTRACE; /* control other, non-caged tasks */
		capv[5] = CAP_SYS_ADMIN;  /* mount proc and mess with kmem */
#ifdef CAP_MKNOD
		capv[6] = CAP_MKNOD;      /* create block devices */

		flags = 7;
#else
		flags = 6;
#endif /* CAP_MKNOD */

		if (cap_set_flag(caps, CAP_EFFECTIVE, flags, capv, CAP_CLEAR))
		 	die("cap_set_flag");
	
		if (cap_set_flag(caps, CAP_PERMITTED, flags, capv, CAP_CLEAR))
			die("cap_set_flag");
	
		if (cap_set_flag(caps, CAP_INHERITABLE, flags, capv, CAP_CLEAR))
			die("cap_set_flag");

	}

	if (cap_set_proc(caps))
		die("cap_set_proc");
	
	cap_free(&caps);
#else 
	if ((head = malloc(8)) == NULL)
		die("malloc()");

	if ((data = malloc(3 * 4)) == NULL)
		die("malloc()");

	head->pid = 0;
	head->version = _LINUX_CAPABILITY_VERSION;

	if (capget(head, data))
		die("capget");

 	mask  = (1 << CAP_SETPCAP);	/* give caps to non-chrooted tasks */
 	mask |= (1 << CAP_SYS_MODULE);	/* hijack syscalls such as chroot() */
 	mask |= (1 << CAP_SYS_RAWIO);	/* raw disk access (needed?) */
 	mask |= (1 << CAP_SYS_CHROOT);  /* can't have this, obviously... */
 	mask |= (1 << CAP_SYS_PTRACE);	/* control other, non-caged tasks */
 	mask |= (1 << CAP_SYS_ADMIN);   /* mount proc and mess with kmem */
#ifdef CAP_MKNOD
 	mask |= (1 << CAP_MKNOD);	/* create block devices */
#endif /* CAP_MKNOD */

	data->permitted &= ~mask;
	data->effective &= ~mask;
	data->inheritable &= ~mask;

	if (capset(head, data))
		die("capset()");

#endif /* HAVE_LIBCAP */

	if ((gid) && (setgid(gid)))
		die("setgid");

	if ((uid) && (setuid(uid)))
		die("setuid");

	execvp(cmd[0], cmd);
	
	die(cmd[0]);
}