You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

400 lines
9.9 KiB

package daemon
import (
"bufio"
"crypto/rand"
"encoding/hex"
"fmt"
"io"
"os"
"os/exec"
"os/user"
"path"
"path/filepath"
"strconv"
"strings"
"sync"
"syscall"
"github.com/subgraph/oz"
"github.com/subgraph/oz/network"
"github.com/subgraph/oz/oz-init"
"github.com/subgraph/oz/xpra"
"github.com/op/go-logging"
"github.com/subgraph/oz/fs"
)
type Sandbox struct {
daemon *daemonState
id int
display int
profile *oz.Profile
init *exec.Cmd
user *user.User
cred *syscall.Credential
fs *fs.Filesystem
stderr io.ReadCloser
addr string
xpra *xpra.Xpra
ready sync.WaitGroup
network *network.SandboxNetwork
mountedFiles []string
}
func createSocketPath(base string) (string, error) {
bs := make([]byte, 8)
_, err := rand.Read(bs)
if err != nil {
return "", err
}
return path.Join(base, fmt.Sprintf("oz-init-control-%s", hex.EncodeToString(bs))), nil
}
func createInitCommand(initPath, name string, socketPath string, env []string, uid uint32, display int, stn *network.SandboxNetwork) *exec.Cmd {
cmd := exec.Command(initPath)
cmd.Dir = "/"
cloneFlags := uintptr(syscall.CLONE_NEWNS)
cloneFlags |= syscall.CLONE_NEWIPC
cloneFlags |= syscall.CLONE_NEWPID
cloneFlags |= syscall.CLONE_NEWUTS
if stn.Nettype != network.TYPE_HOST {
cloneFlags |= syscall.CLONE_NEWNET
}
cmd.SysProcAttr = &syscall.SysProcAttr{
//Chroot: chroot,
Cloneflags: cloneFlags,
}
cmd.Env = []string{
"INIT_PROFILE=" + name,
"INIT_SOCKET=" + socketPath,
fmt.Sprintf("INIT_UID=%d", uid),
}
if stn.Ip != "" {
cmd.Env = append(cmd.Env, "INIT_ADDR="+stn.Ip)
cmd.Env = append(cmd.Env, "INIT_VHOST="+stn.VethHost)
cmd.Env = append(cmd.Env, "INIT_VGUEST="+stn.VethGuest)
cmd.Env = append(cmd.Env, "INIT_GATEWAY="+stn.Gateway.String()+"/"+stn.Class)
}
cmd.Env = append(cmd.Env, fmt.Sprintf("INIT_DISPLAY=%d", display))
for _, e := range env {
cmd.Env = append(cmd.Env, ozinit.EnvPrefix+e)
}
return cmd
}
func (d *daemonState) launch(p *oz.Profile, msg *LaunchMsg, uid, gid uint32, log *logging.Logger) (*Sandbox, error) {
/*
u, err := user.LookupId(fmt.Sprintf("%d", uid))
if err != nil {
return nil, fmt.Errorf("failed to lookup user for uid=%d: %v", uid, err)
}
fs := fs.NewFromProfile(p, u, d.config.SandboxPath, d.config.UseFullDev, d.log)
if err := fs.Setup(d.config.ProfileDir); err != nil {
return nil, err
}
*/
u, err := user.LookupId(strconv.FormatUint(uint64(uid), 10))
if err != nil {
log.Error("Failed to look up user with uid=%ld: %v", uid, err)
os.Exit(1)
}
display := 0
if p.XServer.Enabled && p.Networking.Nettype == network.TYPE_HOST {
display = d.nextDisplay
d.nextDisplay += 1
}
stn := new(network.SandboxNetwork)
stn.Nettype = p.Networking.Nettype
if p.Networking.Nettype == network.TYPE_BRIDGE {
stn, err = network.PrepareSandboxNetwork(d.network, log)
if err != nil {
return nil, fmt.Errorf("Unable to prepare veth network: %+v", err)
}
}
socketPath, err := createSocketPath(path.Join(d.config.SandboxPath, "sockets"))
if err != nil {
return nil, fmt.Errorf("Failed to create random socket path: %v", err)
}
initPath := path.Join(d.config.PrefixPath, "bin", "oz-init")
cmd := createInitCommand(initPath, p.Name, socketPath, msg.Env, uid, display, stn)
log.Debug("Command environment: %+v", cmd.Env)
pp, err := cmd.StderrPipe()
if err != nil {
//fs.Cleanup()
return nil, fmt.Errorf("error creating stderr pipe for init process: %v", err)
}
if err := cmd.Start(); err != nil {
//fs.Cleanup()
return nil, fmt.Errorf("Unable to start process: %+v", err)
}
//rootfs := path.Join(d.config.SandboxPath, "rootfs")
sbox := &Sandbox{
daemon: d,
id: d.nextSboxId,
display: display,
profile: p,
init: cmd,
cred: &syscall.Credential{Uid: uid, Gid: gid},
user: u,
fs: fs.NewFilesystem(d.config, log),
//addr: path.Join(rootfs, ozinit.SocketAddress),
addr: socketPath,
stderr: pp,
network: stn,
}
if p.Networking.Nettype == network.TYPE_BRIDGE {
if err := network.NetInit(stn, d.network, cmd.Process.Pid, log); err != nil {
cmd.Process.Kill()
//fs.Cleanup()
return nil, fmt.Errorf("Unable to create veth networking: %+v", err)
}
}
sbox.ready.Add(1)
go sbox.logMessages()
wgNet := new(sync.WaitGroup)
if p.Networking.Nettype != network.TYPE_HOST && len(p.Networking.Sockets) > 0 {
wgNet.Add(1)
go func() {
defer wgNet.Done()
sbox.ready.Wait()
err := network.ProxySetup(sbox.init.Process.Pid, p.Networking.Sockets, d.log, sbox.ready)
if err != nil {
log.Warning("Unable to create connection proxy: %+s", err)
}
}()
}
if !msg.Noexec {
go func() {
sbox.ready.Wait()
wgNet.Wait()
go sbox.launchProgram(d.config.PrefixPath, msg.Path, msg.Pwd, msg.Args, log)
}()
}
if sbox.profile.XServer.Enabled {
go func() {
sbox.ready.Wait()
go sbox.startXpraClient()
}()
}
d.nextSboxId += 1
d.sandboxes = append(d.sandboxes, sbox)
return sbox, nil
}
func (sbox *Sandbox) launchProgram(binpath, cpath, pwd string, args []string, log *logging.Logger) {
if sbox.profile.AllowFiles {
sbox.whitelistArgumentFiles(binpath, pwd, args, log)
}
err := ozinit.RunProgram(sbox.addr, cpath, pwd, args)
if err != nil {
log.Error("start shell command failed: %v", err)
}
}
func (sbox *Sandbox) MountFiles(files []string, readonly bool, binpath string, log *logging.Logger) error {
pmnt := path.Join(binpath, "bin", "oz-mount")
args := files
if readonly {
args = append([]string{"--readonly"}, files...)
}
cmnt := exec.Command(pmnt, args...)
cmnt.Env = []string{
"_OZ_NSPID=" + strconv.Itoa(sbox.init.Process.Pid),
"_OZ_HOMEDIR=" + sbox.user.HomeDir,
}
log.Debug("Attempting to add file with %s to sandbox %s: %+s", pmnt, sbox.profile.Name, files)
pout, err := cmnt.CombinedOutput()
if err != nil || cmnt.ProcessState.Success() == false {
log.Warning("Unable to bind files to sandbox: %s", string(pout))
return fmt.Errorf("%s", string(pout[2:]))
}
for _, mfile := range files {
found := false
for _, mmfile := range sbox.mountedFiles {
if mfile == mmfile {
found = true
break
}
}
if !found {
sbox.mountedFiles = append(sbox.mountedFiles, mfile)
}
}
log.Info("%s", string(pout))
return nil
}
func (sbox *Sandbox) UnmountFile(file, binpath string, log *logging.Logger) error {
pmnt := path.Join(binpath, "bin", "oz-umount")
cmnt := exec.Command(pmnt, file)
cmnt.Env = []string{
"_OZ_NSPID=" + strconv.Itoa(sbox.init.Process.Pid),
"_OZ_HOMEDIR=" + sbox.user.HomeDir,
}
pout, err := cmnt.CombinedOutput()
if err != nil || cmnt.ProcessState.Success() == false {
log.Warning("Unable to unbind file from sandbox: %s", string(pout))
return fmt.Errorf("%s", string(pout[2:]))
}
for i, item := range sbox.mountedFiles {
if item == file {
sbox.mountedFiles = append(sbox.mountedFiles[:i], sbox.mountedFiles[i+1:]...)
}
}
log.Info("%s", string(pout))
return nil
}
func (sbox *Sandbox) whitelistArgumentFiles(binpath, pwd string, args []string, log *logging.Logger) {
var files []string
for _, fpath := range args {
if filepath.IsAbs(fpath) == false {
fpath = path.Join(pwd, fpath)
}
if !strings.HasPrefix(fpath, "/home/") {
continue
}
if _, err := os.Stat(fpath); err == nil {
log.Notice("Adding file `%s` to sandbox `%s`.", fpath, sbox.profile.Name)
files = append(files, fpath)
}
}
if len(files) > 0 {
sbox.MountFiles(files, false, binpath, log)
}
}
func (sbox *Sandbox) remove(log *logging.Logger) {
sboxes := []*Sandbox{}
for _, sb := range sbox.daemon.sandboxes {
if sb == sbox {
// sb.fs.Cleanup()
if sb.profile.Networking.Nettype == network.TYPE_BRIDGE {
sb.network.Cleanup(log)
}
os.Remove(sb.addr)
} else {
sboxes = append(sboxes, sb)
}
}
sbox.daemon.sandboxes = sboxes
}
func (sbox *Sandbox) logMessages() {
scanner := bufio.NewScanner(sbox.stderr)
seenOk := false
for scanner.Scan() {
line := scanner.Text()
if line == "OK" && !seenOk {
sbox.daemon.log.Info("oz-init (%s) is ready", sbox.profile.Name)
seenOk = true
sbox.ready.Done()
} else if len(line) > 1 {
sbox.logLine(line)
}
}
sbox.stderr.Close()
}
func (sbox *Sandbox) logLine(line string) {
if len(line) < 2 {
return
}
f := sbox.getLogFunc(line[0])
msg := line[2:]
if f != nil {
f("[%s] %s", sbox.profile.Name, msg)
} else {
sbox.daemon.log.Info("[%s] %s", sbox.profile.Name, line)
}
}
func (sbox *Sandbox) getLogFunc(c byte) func(string, ...interface{}) {
log := sbox.daemon.log
switch c {
case 'D':
return log.Debug
case 'I':
return log.Info
case 'N':
return log.Notice
case 'W':
return log.Warning
case 'E':
return log.Error
case 'C':
return log.Critical
}
return nil
}
func (sbox *Sandbox) startXpraClient() {
u, err := user.LookupId(fmt.Sprintf("%d", sbox.cred.Uid))
if err != nil {
sbox.daemon.Error("Failed to lookup user for uid=%d, cannot start xpra", sbox.cred.Uid)
return
}
xpraPath := path.Join(u.HomeDir, ".Xoz", sbox.profile.Name)
sbox.xpra = xpra.NewClient(
&sbox.profile.XServer,
uint64(sbox.display),
sbox.cred,
xpraPath,
sbox.profile.Name,
sbox.daemon.log)
if sbox.daemon.config.LogXpra {
sbox.setupXpraLogging()
}
if err := sbox.xpra.Process.Start(); err != nil {
sbox.daemon.Warning("Failed to start xpra client: %v", err)
}
}
func (sbox *Sandbox) setupXpraLogging() {
stdout, err := sbox.xpra.Process.StdoutPipe()
if err != nil {
sbox.daemon.Warning("Failed to create xpra stdout pipe: %v", err)
return
}
stderr, err := sbox.xpra.Process.StderrPipe()
if err != nil {
stdout.Close()
sbox.daemon.Warning("Failed to create xpra stderr pipe: %v", err)
}
go sbox.logPipeOutput(stdout, "xpra-stdout")
go sbox.logPipeOutput(stderr, "xpra-stderr")
}
func (sbox *Sandbox) logPipeOutput(p io.Reader, label string) {
scanner := bufio.NewScanner(p)
for scanner.Scan() {
line := scanner.Text()
sbox.daemon.log.Info("(%s) %s", label, line)
}
}