summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* fixup! Make setuid + no-unprivileged user namespaces workexport/flatpak/0.6.2Alexander Larsson2016-05-241-1/+1
|
* Add --unshare-user-tryexport/flatpak/0.6.1Alexander Larsson2016-05-231-0/+10
| | | | | | | | This optionally enables user namespaces, but ignores it if its not supported by the kernel. Note: For this to make any sense, bwrap has to be setuid, because unprivileged use requires user namespaces.
* Make setuid + no-unprivileged user namespaces workAlexander Larsson2016-05-232-11/+70
| | | | | | | | | | | | | | | On e.g. debian by default unprivileged namespaces are not allowed. Typically the setuid mode is then used. However, if /dev is mounted (and thus devpts) then we need to do some workaround in how we create the uid/gid maps so uid 0 is mapped while we mount devpts. Unfortunately the way we were working around that is by using an unprivileged unshare(NEWUSER) in the sandbox, which doesn't work. See https://github.com/flatpak/flatpak/issues/2 for details. We work around this by mapping uid/gid 0 + the user. However, since this is a privileged operation we need to do that in the parent namespace, and we need setuid/setgid rights.
* Use #pragma once for headersColin Walters2016-05-193-12/+3
| | | | | | | | | | It's shorter and more reliable. Also GCC/CLang specific, but that's fine because that's all we support anyways. Closes: #69 Closes: #70 Approved by: mrunalp
* Use struct initializerMrunal Patel2016-05-191-6/+6
| | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #68 Approved by: cgwalters
* Ran uncruftify.shAlexander Larsson2016-05-136-377/+420
| | | | | Closes: #67 Approved by: cgwalters
* Add uncruftify configAlexander Larsson2016-05-132-0/+138
| | | | | Closes: #67 Approved by: cgwalters
* send --help to stdoutLars Kellogg-Stedman2016-05-121-6/+6
| | | | | | | | | | | sending --help output to stderr causing sadness and confusion when someone tries something obvious like `bwrap --help | less`. This commit modifies bubblewrap.c such that `--help` output will go to stdout, while other invocations of `usage(...)` will continue to go to stderr. Closes: #66 Approved by: cgwalters
* Add support for --try-unshare-cgroup flagMrunal Patel2016-05-122-0/+13
| | | | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> This flag will unshare cgroups only if supported else will skip it. Closes: #62 Approved by: alexlarsson
* Add support for --unshare-cgroupMrunal Patel2016-05-122-0/+25
| | | | | | | | | | | This requires linux kernel version 4.6 or higher. We check for the presence of /proc/self/ns/cgroup to determine if it is supported or not. Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #62 Approved by: alexlarsson
* Convert tabs to spacesMrunal Patel2016-05-125-46/+46
| | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #65 Approved by: cgwalters
* More robust handler for OOM conditionPavel Odvody2016-05-121-1/+2
| | | | | Closes: #63 Approved by: cgwalters
* Fix fdwalkAlexander Larsson2016-05-091-1/+1
| | | | | | | | It turns out you can't readdir from an O_PATH file-descriptor, so fdwalk didn't work. Spotted the BADFD in a strace. Closes: #60 Approved by: cgwalters
* utils: Rename strdup_printf -> xasprintfColin Walters2016-05-073-11/+11
| | | | | | | I find this clearer since I know about `asprintf`, and the `x` prefix. Closes: #55 Approved by: alexlarsson
* Update documentation for --mqueueMrunal Patel2016-05-071-0/+4
| | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #59 Approved by: alexlarsson
* Add support for mounting mqueueMrunal Patel2016-05-061-1/+25
| | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #45 Approved by: cgwalters
* Update example to use --tmpfs for /tmpMrunal Patel2016-05-061-1/+1
| | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #58 Approved by: cgwalters
* Fix typos and whitespaceMrunal Patel2016-05-062-2/+2
| | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #57 Approved by: cgwalters
* Limit maximum number of arguments to 9000Colin Walters2016-05-061-5/+31
| | | | | | | | | | | | | This is a variation on the previous commit to avoid recursive parsing of `--args`. Here we limit the total number of options to something reasonable. This is inspired by http://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html which required 15 million arguments. We come in a bit below that. Closes: #50 Approved by: rhatdan
* Propagate exit status when not in a PID namespaceColin Walters2016-05-061-1/+1
| | | | | | | | | | | | | | | | | | | | | If we're not doing a PID namespace, we don't create a monitor process, which means that the code in `monitor_child()` needs to properly propagate the exit status from the signalfd. It might be better to change `monitor_child()` to be a `waitpid()` loop in this case, but I decided to go for the one liner fix that's an improvement in both cases anyways. I noticed this with: ``` bwrap --ro-bind / / --dev /dev true ``` exiting with code 1. Closes: #49 Approved by: rhatdan
* SELinux: Combine label_valid and label_support into one functionDan Walsh2016-05-063-30/+19
| | | | | | | | | | | | | | | | All calls to set an SELinux label should call this function die_unless_label_valid (opt_exec_label); It will make sure SELinux is enabled and will make sure the user passed in a valid label. Signed-off-by: Alexander Larsson <alexl@redhat.com> Signed-off-by: Dan Walsh <dwalsh@redhat.com> Closes: #53 Approved by: cgwalters
* Add .editorconfig and .dir-locals.elColin Walters2016-05-062-0/+7
| | | | | | | | | | This should hopefully get things more automatic for more editors. I didn't find in a quick search how to teach vim to DTRT by default. Closes: #56 Approved by: rhatdan
* README.md: Note userns unavailablity in CentOS 7 and Debian JessieColin Walters2016-05-061-1/+3
| | | | | | | | Let's be more explicit that we can target production distributions today. Closes: #54 Approved by: rhatdan
* Add error handling for eventfd() and prctl(PR_SET_SECCOMP)Colin Walters2016-05-061-2/+7
| | | | | | | | | | | It's likely possible for callers to use `ulimit()` to cause us to fail `eventfd()` with `EMFILE` - we should handle that. If a caller requests seccomp but for some reason we fail to install it, we shouldn't silently continue. Closes: #52 Approved by: rhatdan
* utils: Add some __attribute__ annotations for format, noreturnColin Walters2016-05-061-4/+4
| | | | | | | | | | | In particular `format` is important for validating strings. Luckily we don't have any new warnings. `noreturn` is mostly just helps avoid other warnings from unreachable code. Closes: #51 Approved by: rhatdan
* Don't support --args inside an --args fileAlexander Larsson2016-05-061-3/+7
| | | | | | | | This would let you create a recursive operation filling up the stack and causing a crash. Closes: #47 Approved by: cgwalters
* Fix using --dev unprivileged (without --proc)Alexander Larsson2016-05-061-1/+1
| | | | | | | | | | | | | If using --dev we need a special workaround to make it possible to mount devpts. Unfortunately the workaround was erronously enabled if you added --proc, not --dev. This moves this check to the right place. To test, try: ./bwrap --ro-bind / / --dev /dev true Closes: #48 Approved by: cgwalters
* Add --tmpfs argumentAlexander Larsson2016-05-062-1/+28
| | | | | | | | This is very useful if you want to cover some area of the filesystem, or if you want to make some part of a read-only tree writable. Closes: #42 Approved by: cgwalters
* Fix couple of typosMrunal Patel2016-05-061-2/+2
| | | | | | | Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Closes: #46 Approved by: rhatdan
* README.md: Note some related projectsColin Walters2016-05-051-0/+46
| | | | | Closes: #44 Approved by: rhatdan
* SELinux: Ensure we validate labelsDan Walsh2016-05-053-4/+18
| | | | | | | | | | Verify you are getting a valid SELinux label before proceeding. Some SELinux checks were broken. Signed-off-by: Dan Walsh <dwalsh@redhat.com> Closes: #43 Approved by: cgwalters
* README: Link to CVE-2016-3135, describe vs userns betterColin Walters2016-05-021-3/+13
| | | | | Closes: #41 Approved by: rhatdan
* spec: Enable selinux by defaultColin Walters2016-05-021-0/+1
| | | | | | | The spec file is really Fedora/RHEL specific. Closes: #40 Approved by: alexlarsson
* spec: Enable man pagesColin Walters2016-05-021-0/+3
| | | | | | | Install the BRs, add the %files. Closes: #40 Approved by: alexlarsson
* Require CAP_NET_ADMINAlexander Larsson2016-04-293-3/+3
| | | | | | | | | It turns out we need CAP_NET_ADMIN in the privileged case in order to make --unshare-net work because otherwise we're not allowed to set up the loopback device. Closes: #38 Approved by: cgwalters
* packaging: Add a spec fileColin Walters2016-04-271-0/+45
| | | | | | | | | This just makes it easier to build an RPM before it gets packaged elsewhere. rpmdistro-gitoverlay e.g. can consume spec files internal to git repos. Closes: #35 Approved by: alexlarsson
* Swap --share-user with --unshare-user, but auto-unshare if !setuidColin Walters2016-04-261-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | We have to support two different ways to run: - As setuid root, for systems without unprivileged userns support - Non-setuid, but require unprivileged userns The fact that we exposed `--share-user` is awkward, because it forced tools that want to work in both case to basically reimplement the logic for detecting userns support, if they didn't care whether or not userns was enabled. For example in the case of `demos/bubblewrap-shell.sh` where we share the invoking UID. This commit changes things so we now default to `--unshare-user` if we're *not* installed privileged, since it's a requirement. The end result here is that we just work out of the box in more scenarios; callers that require the uid mapping portion of userns will still be passing `--uid`, and this will still properly fail if the kernel doesn't have userns. Closes: #36 Closes: #37 Approved by: alexlarsson
* Add LGPLv2+ COPYING (and LICENSE symlink)Colin Walters2016-04-222-0/+482
| | | | | | | | | | | | Not having this is a rather embarassing amateur mistake...one of us should have caught it. We do have LGPLv2+ bits in the headers, but this should make it unmistakable. This code inherited from xdg-app and linux-user-chroot, both of which are LGPLv2+. Closes: #34 Approved by: alexlarsson
* build: Use git.mkColin Walters2016-04-224-17/+354
| | | | | | | It's less manual etc. Closes: #33 Approved by: alexlarsson
* Add bash completionsDan Walsh2016-04-083-0/+73
| | | | | | | | | | This is just the beginning of a framework for bash completions. Current completions just give you the list of options available. Signed-off-by: Dan Walsh <dwalsh@redhat.com> Closes: #30 Approved by: alexlarsson
* Ignore errors when writing to event_fd in a better wayAlexander Larsson2016-04-082-2/+7
| | | | | | | | | | | GCC was failing this because write is marked warn_unused_result. Assigning it to a attribute unused variable is apparently "better" than casting it to void... Also, we avoid taking this path at all if event_fd is -1. Closes: #32 Approved by: alexlarsson
* .gitignore: ignore generated manAntonio Murdaca2016-04-041-0/+1
| | | | | | | Signed-off-by: Antonio Murdaca <runcom@redhat.com> Closes: #31 Approved by: alexlarsson
* Use 64bit capability syscallsAlexander Larsson2016-03-301-25/+21
| | | | | | | | | The rawhide kernel has started to warn about applications using 32bit capabilities calls. We don't actually need more than 32 bits, but lets use the 64bit APIs anyway to stay safe. Closes: #29 Approved by: cgwalters
* utils: Squash const warnings for security contextsColin Walters2016-03-221-2/+2
| | | | | | | It's surprising that `security_context_t` isn't const. Pull request: #27 Approved by: alexlarsson
* main: Squash a compiler warningColin Walters2016-03-221-1/+1
| | | | | | | | AFAICS it's not really possible for `write()` to an eventfd to fail, so squash this warning from Travis. Pull request: #27 Approved by: alexlarsson
* utils: Fix OOM error handling for vasprintf()Colin Walters2016-03-221-4/+2
| | | | | | | | | | | | I noticed on Travis we had a warning about this, and it's actually right, the man page says on OOM the contents of `*strp` are undefined, not `NULL`. (Now possibly it doesn't touch the value, but anyways this follows the man page and fixes a compiler warning) Pull request: #27 Approved by: alexlarsson
* build: Add SELinux and priv mode to build configuration outputColin Walters2016-03-221-0/+2
| | | | | | | | | Greater visibility for these is useful. (Alternatively, autoconf could be less verbose but I'm assuming that's not going to happen before the sun explodes). Pull request: #28 Approved by: alexlarsson
* Add configure flags to allow setting setuid/setcapsAlexander Larsson2016-03-222-6/+23
| | | | | | | | | | | | | | | | With this you can e.g. : ./configure --enable-sudo --with-priv-mode=setcaps make make install and it will ask you for sudo password and then make the final binary have the right capabilities set. This is not needed when setting such persmissions in e.g. a spec file, but it is useful for developers building bubblewrap. Pull request: #26 Approved by: cgwalters
* Add SELinux SupportDan Walsh2016-03-226-4/+122
| | | | | | | Signed-off-by: Dan Walsh <dwalsh@redhat.com> Pull request: #25 Approved by: alexlarsson
* README: Add some documentation about the sandboxAlexander Larsson2016-03-181-2/+32
| | | | | Pull request: #24 Approved by: alexlarsson
View Lorry Controller Status