passt/isolation.h

/* SPDX-License-Identifier: AGPL-3.0-or-later
 * Copyright Red Hat
 * Author: Stefano Brivio <sbrivio@redhat.com>
 * Author: David Gibson <david@gibson.dropbear.id.au>
 */

#ifndef ISOLATION_H
#define ISOLATION_H

void isolate_initial(void);
void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns,
		  enum passt_modes mode);
int isolate_prefork(struct ctx *c);
void isolate_postfork(const struct ctx *c);

#endif /* ISOLATION_H */
Move self-isolation code into a separate file passt/pasta contains a number of routines designed to isolate passt from the rest of the system for security. These are spread through util.c and passt.c. Move them together into a new isolation.c file. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> 2022-09-12 12:24:03 +00:00			`/* SPDX-License-Identifier: AGPL-3.0-or-later`
			`* Copyright Red Hat`
			`* Author: Stefano Brivio <sbrivio@redhat.com>`
			`* Author: David Gibson <david@gibson.dropbear.id.au>`
			`*/`

			`#ifndef ISOLATION_H`
			`#define ISOLATION_H`

isolation: Clarify various self-isolation steps We have a number of steps of self-isolation scattered across our code. Improve function names and add comments to make it clearer what the self isolation model is, what the steps do, and why they happen at the points they happen. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2022-10-14 04:25:31 +00:00			`void isolate_initial(void);`
isolation: Replace drop_caps() with a version that actually does something The current implementation of drop_caps() doesn't really work because it attempts to drop capabilities from the bounding set. That's not the set that really matters, it's about limiting the abilities of things we might later exec() rather than our own capabilities. It also requires CAP_SETPCAP which we won't usually have. Replace it with a new version which uses setcap(2) to drop capabilities from the effective and permitted sets. For now we leave the inheritable set as is, since we don't want to preclude the user from passing inheritable capabilities to the command spawed by pasta. Correctly dropping caps reveals that we were relying on some capabilities we'd supposedly dropped. Re-divide the dropping of capabilities between isolate_initial(), isolate_user() and isolate_prefork() to make this work. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2022-10-14 04:25:34 +00:00			`void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns,`
			`enum passt_modes mode);`
isolation: Clarify various self-isolation steps We have a number of steps of self-isolation scattered across our code. Improve function names and add comments to make it clearer what the self isolation model is, what the steps do, and why they happen at the points they happen. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2022-10-14 04:25:31 +00:00			`int isolate_prefork(struct ctx *c);`
			`void isolate_postfork(const struct ctx *c);`
Move self-isolation code into a separate file passt/pasta contains a number of routines designed to isolate passt from the rest of the system for security. These are spread through util.c and passt.c. Move them together into a new isolation.c file. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> 2022-09-12 12:24:03 +00:00
			`#endif /* ISOLATION_H */`