summaryrefslogtreecommitdiffstats
path: root/utils
diff options
context:
space:
mode:
authorEtienne CHAMPETIER <champetier.etienne@gmail.com>2015-08-27 01:26:44 +0200
committerJohn Crispin <blogic@openwrt.org>2015-10-03 08:57:29 +0200
commita4505284b4d257b490cccd77a50c9c052854e7d5 (patch)
treebf994c57b38c2cfdd55ecb6fe7b078ba23b030ab /utils
parent2059c75baa34f0f5952eedea6c25ae42232e89e5 (diff)
downloadunitd-a4505284b4d257b490cccd77a50c9c052854e7d5.tar
unitd-a4505284b4d257b490cccd77a50c9c052854e7d5.zip
jail: reworks & cleanups
-use EXIT_SUCCESS/EXIT_FAILURE (not -1) -parse every option in main, put them in opts struct -add CLONE_NEWIPC to the clone() call (it's already compiled in openwrt kernel) -return the exit status of the jailed process, or the num of the signal that killed it -add missing options to usage() -add a warning in usage() about ujail security -debug option can now take an int as parameter (~debug level), with -d2 you now activate "LD_DEBUG=all" for exemple -do not depend on libpreload-seccomp.so if -S is not present -there is now only one ujail process instead of two jail creation is now as follow: 1) create jail root dir (mkdir) 2) create new namespace (clone) (in the parent wait for the child with uloop) 3) build the jail root fs (mount bind all the libs/bins ...), pivot_root and mount special fs (procfs, sysfs) (build_jail_fs()) 4) build envp (LD_PRELOAD the seccomp helper or ...) 5) drop capabilities (next patch) 6) execve the jailed bin 7) remove jail root dir (once child is dead) there is no need to umount anything because we are already in a namespace Todo: -allow signals from the parent to the child Feature request: -when we add a file or dir, detect if it's an exec and add it's dependencies Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
Diffstat (limited to 'utils')
0 files changed, 0 insertions, 0 deletions