passt/isolation.h

/* SPDX-License-Identifier: AGPL-3.0-or-later
 * Copyright Red Hat
 * Author: Stefano Brivio <sbrivio@redhat.com>
 * Author: David Gibson <david@gibson.dropbear.id.au>
 */

#ifndef ISOLATION_H
#define ISOLATION_H

void drop_caps(void);
void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns);
int sandbox(struct ctx *c);
void seccomp(const struct ctx *c);

#endif /* ISOLATION_H */
Move self-isolation code into a separate file passt/pasta contains a number of routines designed to isolate passt from the rest of the system for security. These are spread through util.c and passt.c. Move them together into a new isolation.c file. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> 2022-09-12 12:24:03 +00:00			`/* SPDX-License-Identifier: AGPL-3.0-or-later`
			`* Copyright Red Hat`
			`* Author: Stefano Brivio <sbrivio@redhat.com>`
			`* Author: David Gibson <david@gibson.dropbear.id.au>`
			`*/`

			`#ifndef ISOLATION_H`
			`#define ISOLATION_H`

			`void drop_caps(void);`
Handle userns isolation and dropping root at the same time passt/pasta can interact with user namespaces in a number of ways: 1) With --netns-only we'll remain in our original user namespace 2) With --userns or a PID option to pasta we'll join either the given user namespace or that of the PID 3) When pasta spawns a shell or command we'll start a new user namespace for the command and then join it 4) With passt we'll create a new user namespace when we sandbox() ourself However (3) and (4) turn out to have essentially the same effect. In both cases we create one new user namespace. The spawned command starts there, and passt/pasta itself will live there from sandbox() onwards. Because of this, we can simplify user namespace handling by moving the userns handling earlier, to the same point we drop root in the original namespace. Extend the drop_user() function to isolate_user() which does both. After switching UID and GID in the original userns, isolate_user() will either join or create the userns we require. When we spawn a command with pasta_start_ns()/pasta_setup_ns() we no longer need to create a userns, because we're already made one. sandbox() likewise no longer needs to create (or join) an userns because we're already in the one we need. We no longer need c->pasta_userns_fd, since the fd is only used locally in isolate_user(). Likewise we can replace c->netns_only with a local in conf(), since it's not used outside there. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> 2022-09-12 12:24:07 +00:00			`void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns);`
Move self-isolation code into a separate file passt/pasta contains a number of routines designed to isolate passt from the rest of the system for security. These are spread through util.c and passt.c. Move them together into a new isolation.c file. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> 2022-09-12 12:24:03 +00:00			`int sandbox(struct ctx *c);`
			`void seccomp(const struct ctx *c);`

			`#endif /* ISOLATION_H */`