[OpenWrt-Devel,procd,2/2] ujail: rework file dependencies detection (use ldd)

Using ldd (via popen()) is a hack, but it's simpler (and working)
we have 3 libc and many archs, too many ways to resolve .so

Current code:
-do not parse the intepreter (PT_INTERP) part of the elf
-do not get the library path priority right (/lib64 is before /lib,
musl take the libs in /lib even on 64bits images)
-do not handle RPATH

This patch:
-use ldd to detect ELF dependencies
-add support for shell script

uClibc ldd doesn't work with shared lib, thus this patch break
seccomp with uClibc

Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
---
 CMakeLists.txt |   2 +-
 jail/deps.c    | 198 ++++++++++++++++++++++++++++++++
 jail/deps.h    |  23 ++++
 jail/elf.c     | 355 ---------------------------------------------------------
 jail/elf.h     |  38 ------
 jail/jail.c    | 138 +++++++---------------
 jail/jail.h    |  18 +++
 7 files changed, 284 insertions(+), 488 deletions(-)
 create mode 100644 jail/deps.c
 create mode 100644 jail/deps.h
 delete mode 100644 jail/elf.c
 delete mode 100644 jail/elf.h
 create mode 100644 jail/jail.h

Hi,

can you please convert this to c code ? we dont like c++ patterns

	John

On 21/11/2015 00:05, Etienne CHAMPETIER wrote:
> Using ldd (via popen()) is a hack, but it's simpler (and working)
> we have 3 libc and many archs, too many ways to resolve .so
> 
> Current code:
> -do not parse the intepreter (PT_INTERP) part of the elf
> -do not get the library path priority right (/lib64 is before /lib,
> musl take the libs in /lib even on 64bits images)
> -do not handle RPATH
> 
> This patch:
> -use ldd to detect ELF dependencies
> -add support for shell script
> 
> uClibc ldd doesn't work with shared lib, thus this patch break
> seccomp with uClibc
> 
> Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
> ---
>  CMakeLists.txt |   2 +-
>  jail/deps.c    | 198 ++++++++++++++++++++++++++++++++
>  jail/deps.h    |  23 ++++
>  jail/elf.c     | 355 ---------------------------------------------------------
>  jail/elf.h     |  38 ------
>  jail/jail.c    | 138 +++++++---------------
>  jail/jail.h    |  18 +++
>  7 files changed, 284 insertions(+), 488 deletions(-)
>  create mode 100644 jail/deps.c
>  create mode 100644 jail/deps.h
>  delete mode 100644 jail/elf.c
>  delete mode 100644 jail/elf.h
>  create mode 100644 jail/jail.h
> 
> diff --git a/CMakeLists.txt b/CMakeLists.txt
> index d749c25..8e3f7ea 100644
> --- a/CMakeLists.txt
> +++ b/CMakeLists.txt
> @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)
>  endif()
>  
>  IF(JAIL_SUPPORT)
> -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)
> +ADD_EXECUTABLE(ujail jail/jail.c jail/deps.c jail/capabilities.c)
>  TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)
>  INSTALL(TARGETS ujail
>  	RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
> diff --git a/jail/deps.c b/jail/deps.c
> new file mode 100644
> index 0000000..0141cef
> --- /dev/null
> +++ b/jail/deps.c
> @@ -0,0 +1,198 @@
> +/*
> + * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#define _GNU_SOURCE
> +
> +#include <assert.h>
> +#include <elf.h>
> +#include <errno.h>
> +#include <fcntl.h>
> +#include <libgen.h>
> +#include <linux/limits.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/mount.h>
> +#include <sys/stat.h>
> +#include <sys/types.h>
> +#include <unistd.h>
> +
> +#include <libubox/avl.h>
> +#include <libubox/avl-cmp.h>
> +
> +#include "deps.h"
> +#include "log.h"
> +#include "jail.h"
> +
> +struct mount {
> +        struct avl_node avl;
> +        const char *path;
> +        int readonly;
> +        int error;
> +};
> +
> +struct avl_tree mounts;
> +
> +static int add_mount(const char *path, int readonly, int error)
> +{
> +	if (avl_find(&mounts, path))
> +		return 1;
> +
> +	struct mount *m;
> +	m = calloc(1, sizeof(struct mount));
> +	assert(m != NULL);
> +	m->avl.key = m->path = strdup(path);
> +	m->readonly = readonly;
> +	m->error = error;
> +
> +	avl_insert(&mounts, &m->avl);
> +	DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly, m->error != 0);
> +	return 0;
> +}
> +
> +int add_mount_if_exists(const char *path, int readonly, int error) {
> +	struct stat s;
> +	if (stat(path, &s) == -1) {
> +		DEBUG("%s doesn't exist\n", path);
> +		return -1;
> +	}
> +	return add_mount(path, readonly, error);
> +}
> +
> +int mount_all(const char *jailroot) {
> +	struct mount *m;
> +	avl_for_each_element(&mounts, m, avl)
> +		if (mount_bind(jailroot, m->path, m->readonly, m->error))
> +			return -1;
> +
> +	return 0;
> +}
> +
> +void mount_list_init() {
> +	avl_init(&mounts, avl_strcmp, false, NULL);
> +}
> +
> +//we already read 2 char from f (#!)
> +static int add_script_deps(FILE *f, const char *path, int readonly, int error)
> +{
> +	char buf[PATH_MAX];
> +	int i = 0;
> +	int c;
> +	while ((c = fgetc(f)) != EOF) {
> +		if (i == 0 && c != '/')
> +			continue;
> +		if (c <= 0x20 || c > 0x7e)
> +			break;
> +		buf[i] = c;
> +		i++;
> +		if (i >= sizeof(buf)) {
> +			ERROR("script interpretor too long (%s)\n", path);
> +			return -1;
> +		}
> +	}
> +	buf[i] = '\0';
> +	return add_path_and_deps(buf, readonly, error);
> +}
> +
> +static int add_elf_deps(const char *path, int readonly, int error)
> +{
> +	char buf[PATH_MAX];
> +	int nb = snprintf(buf, sizeof(buf), "ldd %s", path);
> +	assert(nb >= 0);
> +
> +	FILE *f = popen(buf, "r");
> +	char c;
> +	int i = 0;
> +	while (((c = fgetc(f)) != EOF)) {
> +		if (i == 0 && c != '/') {
> +			continue;
> +		} else if (i > 0 && (c <= ' ' || c > '~')) {
> +			buf[i] = '\0';
> +			add_mount(buf, readonly, error);
> +			i = 0;
> +		} else if (i > 0 || c == '/') {
> +			buf[i] = c;
> +			i++;
> +		}
> +
> +		if (i >= sizeof(buf)) {
> +			ERROR("shared lib too long (%s)\n", path);
> +			return -1;
> +		}
> +	}
> +	pclose(f);
> +	return 0;
> +}
> +
> +int add_path_and_deps(const char *path, int readonly, int error)
> +{
> +	assert(path != NULL);
> +
> +	if (path[0] != '/') {
> +		ERROR("only absolute path are supported (%s)\n", path);
> +		return error;
> +	}
> +
> +	struct stat s;
> +	if (stat(path, &s) == -1) {
> +		ERROR("stat(%s) failed: %s\n", path, strerror(errno));
> +		return error;
> +	}
> +
> +	//path already in list
> +	if (add_mount(path, readonly, error) == 1)
> +		return 0;
> +
> +	if (!S_ISREG(s.st_mode))
> +		return 0;
> +
> +	//too small to be an ELF or a script
> +	if (s.st_size < 4)
> +		return 0;
> +
> +	FILE *f;
> +	if ((f = fopen(path, "r")) == NULL) {
> +		ERROR("fopen(%s) failed: %s\n", path, strerror(errno));
> +		return error;
> +	}
> +
> +	int ret = 0;
> +	int c = fgetc(f);
> +	switch(c) {
> +	//script ?
> +	case '#':
> +		c = fgetc(f);
> +		if (c != '!') {
> +			goto out;
> +		}
> +		//this is a script
> +		ret = add_script_deps(f, path, readonly, error);
> +		goto out;
> +	//elf ?
> +	case ELFMAG0:
> +		if ((c = fgetc(f)) != ELFMAG1
> +			|| (c = fgetc(f)) != ELFMAG2
> +			|| (c = fgetc(f)) != ELFMAG3) {
> +			goto out;
> +		}
> +		ret = add_elf_deps(path, readonly, error);
> +		goto out;
> +	}
> +out:
> +	if (f != NULL)
> +		fclose(f);
> +
> +	return ret;
> +}
> +
> diff --git a/jail/deps.h b/jail/deps.h
> new file mode 100644
> index 0000000..da2a914
> --- /dev/null
> +++ b/jail/deps.h
> @@ -0,0 +1,23 @@
> +/*
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#ifndef _DEPS_H__
> +
> +#include "log.h"
> +
> +int add_mount_if_exists(const char *path, int readonly, int error);
> +int add_path_and_deps(const char *path, int readonly, int error);
> +int mount_all(const char *jailroot);
> +void mount_list_init();
> +
> +#endif
> diff --git a/jail/elf.c b/jail/elf.c
> deleted file mode 100644
> index cbb3051..0000000
> --- a/jail/elf.c
> +++ /dev/null
> @@ -1,355 +0,0 @@
> -/*
> - * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> - *
> - * This program is free software; you can redistribute it and/or modify
> - * it under the terms of the GNU Lesser General Public License version 2.1
> - * as published by the Free Software Foundation
> - *
> - * This program is distributed in the hope that it will be useful,
> - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> - * GNU General Public License for more details.
> - */
> -
> -#define _GNU_SOURCE
> -#include <sys/mman.h>
> -
> -#include <stdlib.h>
> -#include <unistd.h>
> -#include <stdio.h>
> -#include <string.h>
> -#include <sys/stat.h>
> -#include <fcntl.h>
> -#include <libgen.h>
> -#include <glob.h>
> -#include <elf.h>
> -
> -#include <libubox/utils.h>
> -
> -#include "elf.h"
> -
> -struct avl_tree libraries;
> -static LIST_HEAD(library_paths);
> -
> -void alloc_library_path(const char *path)
> -{
> -	struct library_path *p;
> -	char *_path;
> -
> -	p = calloc_a(sizeof(*p),
> -		&_path, strlen(path) + 1);
> -	if (!p)
> -		return;
> -
> -	p->path = strcpy(_path, path);
> -
> -	list_add_tail(&p->list, &library_paths);
> -	DEBUG("adding ld.so path %s\n", path);
> -}
> -
> -static void alloc_library(const char *path, const char *name)
> -{
> -	struct library *l;
> -	char *_name, *_path;
> -
> -	l = calloc_a(sizeof(*l),
> -		&_path, strlen(path) + 1,
> -		&_name, strlen(name) + 1);
> -	if (!l)
> -		return;
> -
> -	l->avl.key = l->name = strcpy(_name, name);
> -	l->path = strcpy(_path, path);
> -
> -	avl_insert(&libraries, &l->avl);
> -	DEBUG("adding library %s/%s\n", path, name);
> -}
> -
> -static int elf_open(char **dir, char *file)
> -{
> -	struct library_path *p;
> -	char path[256];
> -	int fd = -1;
> -
> -	*dir = NULL;
> -
> -	list_for_each_entry(p, &library_paths, list) {
> -		if (strlen(p->path))
> -			snprintf(path, sizeof(path), "%s/%s", p->path, file);
> -		else
> -			strncpy(path, file, sizeof(path));
> -		fd = open(path, O_RDONLY);
> -		if (fd >= 0) {
> -			*dir = p->path;
> -			break;
> -		}
> -	}
> -
> -	if (fd == -1)
> -		fd = open(file, O_RDONLY);
> -
> -	return fd;
> -}
> -
> -char* find_lib(char *file)
> -{
> -	struct library *l;
> -	static char path[256];
> -	const char *p;
> -
> -	l = avl_find_element(&libraries, file, l, avl);
> -	if (!l)
> -		return NULL;
> -
> -	p = l->path;
> -	if (strstr(p, "local"))
> -		p = "/lib";
> -
> -	snprintf(path, sizeof(path), "%s/%s", p, file);
> -
> -	return path;
> -}
> -
> -static int elf64_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
> -{
> -	Elf64_Ehdr *e;
> -	Elf64_Phdr *ph;
> -	int i;
> -
> -	e = (Elf64_Ehdr *) map;
> -	ph = (Elf64_Phdr *) (map + e->e_phoff);
> -
> -	for (i = 0; i < e->e_phnum; i++) {
> -		if (ph[i].p_type == type) {
> -			*offset = ph[i].p_offset;
> -			if (size)
> -				*size = ph[i].p_filesz;
> -			if (vaddr)
> -				*vaddr = ph[i].p_vaddr;
> -			return 0;
> -		}
> -	}
> -
> -	return -1;
> -}
> -
> -static int elf32_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
> -{
> -	Elf32_Ehdr *e;
> -	Elf32_Phdr *ph;
> -	int i;
> -
> -	e = (Elf32_Ehdr *) map;
> -	ph = (Elf32_Phdr *) (map + e->e_phoff);
> -
> -	for (i = 0; i < e->e_phnum; i++) {
> -		if (ph[i].p_type == type) {
> -			*offset = ph[i].p_offset;
> -			if (size)
> -				*size = ph[i].p_filesz;
> -			if (vaddr)
> -				*vaddr = ph[i].p_vaddr;
> -			return 0;
> -		}
> -	}
> -
> -	return -1;
> -}
> -
> -static int elf_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
> -{
> -	int clazz = map[EI_CLASS];
> -
> -	if (clazz == ELFCLASS32)
> -		return elf32_find_section(map, type, offset, size, vaddr);
> -	else if (clazz == ELFCLASS64)
> -		return elf64_find_section(map, type, offset, size, vaddr);
> -
> -	ERROR("unknown elf format %d\n", clazz);
> -
> -	return -1;
> -}
> -
> -static int elf32_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)
> -{
> -	Elf32_Dyn *dynamic = (Elf32_Dyn *) (map + dyn_offset);
> -	char *strtab = NULL;
> -
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf32_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_STRTAB)
> -			continue;
> -
> -		strtab = map + (curr->d_un.d_val - load_offset);
> -		break;
> -	}
> -
> -	if (!strtab)
> -		return -1;
> -
> -	dynamic = (Elf32_Dyn *) (map + dyn_offset);
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf32_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_NEEDED)
> -			continue;
> -
> -		if (elf_load_deps(&strtab[curr->d_un.d_val]))
> -			return -1;
> -	}
> -
> -	return 0;
> -}
> -
> -static int elf64_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)
> -{
> -	Elf64_Dyn *dynamic = (Elf64_Dyn *) (map + dyn_offset);
> -	char *strtab = NULL;
> -
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf64_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_STRTAB)
> -			continue;
> -
> -		strtab = map + (curr->d_un.d_val - load_offset);
> -		break;
> -	}
> -
> -	if (!strtab)
> -		return -1;
> -
> -	dynamic = (Elf64_Dyn *) (map + dyn_offset);
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf64_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_NEEDED)
> -			continue;
> -
> -		if (elf_load_deps(&strtab[curr->d_un.d_val]))
> -			return -1;
> -	}
> -
> -	return 0;
> -}
> -
> -int elf_load_deps(char *library)
> -{
> -	unsigned int dyn_offset, dyn_size;
> -	unsigned int load_offset, load_vaddr;
> -	struct stat s;
> -	char *map = NULL, *dir = NULL;
> -	int clazz, fd, ret = -1;
> -
> -	if (avl_find(&libraries, library))
> -		return 0;
> -
> -	fd = elf_open(&dir, library);
> -
> -	if (fd < 0) {
> -		ERROR("failed to open %s\n", library);
> -		return -1;
> -	}
> -
> -	if (fstat(fd, &s) == -1) {
> -		ERROR("failed to stat %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
> -	if (map == MAP_FAILED) {
> -		ERROR("failed to mmap %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	if (elf_find_section(map, PT_LOAD, &load_offset, NULL, &load_vaddr)) {
> -		ERROR("failed to load the .load section from %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size, NULL)) {
> -		ERROR("failed to load the .dynamic section from %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	if (dir) {
> -		alloc_library(dir, library);
> -	} else {
> -		char *elf = strdup(library);
> -
> -		alloc_library(dirname(elf), basename(library));
> -		free(elf);
> -	}
> -	clazz = map[EI_CLASS];
> -
> -	if (clazz == ELFCLASS32)
> -		ret = elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
> -	else if (clazz == ELFCLASS64)
> -		ret = elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
> -
> -err_out:
> -	if (map)
> -		munmap(map, s.st_size);
> -	close(fd);
> -
> -	return ret;
> -}
> -
> -void load_ldso_conf(const char *conf)
> -{
> -	FILE* fp = fopen(conf, "r");
> -	char line[256];
> -
> -	if (!fp) {
> -		DEBUG("failed to open %s\n", conf);
> -		return;
> -	}
> -
> -	while (!feof(fp)) {
> -		int len;
> -
> -		if (!fgets(line, 256, fp))
> -			break;
> -		len = strlen(line);
> -		if (len < 2)
> -			continue;
> -		if (*line == '#')
> -			continue;
> -		if (line[len - 1] == '\n')
> -			line[len - 1] = '\0';
> -		if (!strncmp(line, "include ", 8)) {
> -			char *sep = strstr(line, " ");
> -			glob_t gl;
> -			int i;
> -
> -			if (!sep)
> -				continue;;
> -			while (*sep == ' ')
> -				sep++;
> -			if (glob(sep, GLOB_NOESCAPE | GLOB_MARK, NULL, &gl)) {
> -				ERROR("glob failed on %s\n", sep);
> -				continue;
> -			}
> -			for (i = 0; i < gl.gl_pathc; i++)
> -				load_ldso_conf(gl.gl_pathv[i]);
> -			globfree(&gl);
> -		} else {
> -			struct stat s;
> -
> -			if (stat(line, &s))
> -				continue;
> -			alloc_library_path(line);
> -		}
> -	}
> -
> -	fclose(fp);
> -}
> diff --git a/jail/elf.h b/jail/elf.h
> deleted file mode 100644
> index 3ae311e..0000000
> --- a/jail/elf.h
> +++ /dev/null
> @@ -1,38 +0,0 @@
> -/*
> - * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> - *
> - * This program is free software; you can redistribute it and/or modify
> - * it under the terms of the GNU Lesser General Public License version 2.1
> - * as published by the Free Software Foundation
> - *
> - * This program is distributed in the hope that it will be useful,
> - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> - * GNU General Public License for more details.
> - */
> -
> -#ifndef _ELF_H__
> -#include <libubox/avl.h>
> -#include <libubox/avl-cmp.h>
> -
> -#include "log.h"
> -
> -struct library {
> -	struct avl_node avl;
> -	char *name;
> -	char *path;
> -};
> -
> -struct library_path {
> -	struct list_head list;
> -	char *path;
> -};
> -
> -extern struct avl_tree libraries;
> -
> -extern void alloc_library_path(const char *path);
> -extern char* find_lib(char *file);
> -extern int elf_load_deps(char *library);
> -extern void load_ldso_conf(const char *conf);
> -
> -#endif
> diff --git a/jail/jail.c b/jail/jail.c
> index 08babde..391c196 100644
> --- a/jail/jail.c
> +++ b/jail/jail.c
> @@ -12,27 +12,28 @@
>   */
>  
>  #define _GNU_SOURCE
> -#include <sys/mount.h>
> -#include <sys/prctl.h>
> -#include <sys/wait.h>
>  
> -#include <stdlib.h>
> -#include <unistd.h>
> -#include <values.h>
>  #include <errno.h>
> -#include <stdio.h>
> -#include <string.h>
> -#include <sys/stat.h>
>  #include <fcntl.h>
>  #include <libgen.h>
> +#include <linux/limits.h>
>  #include <sched.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/mount.h>
> +#include <sys/prctl.h>
> +#include <sys/stat.h>
> +#include <sys/wait.h>
> +#include <unistd.h>
>  
> -#include "elf.h"
> -#include "capabilities.h"
> -
> -#include <libubox/list.h>
>  #include <libubox/uloop.h>
>  
> +#include "capabilities.h"
> +#include "deps.h"
> +#include "jail.h"
> +#include "log.h"
> +
>  #define STACK_SIZE	(1024 * 1024)
>  #define OPT_ARGS	"P:S:C:n:r:w:d:psulo"
>  
> @@ -48,16 +49,6 @@ static struct {
>  	int sysfs;
>  } opts;
>  
> -struct extra {
> -	struct list_head list;
> -
> -	const char *path;
> -	const char *name;
> -	int readonly;
> -};
> -
> -static LIST_HEAD(extras);
> -
>  extern int pivot_root(const char *new_root, const char *put_old);
>  
>  int debug = 0;
> @@ -89,42 +80,34 @@ static int mkdir_p(char *dir, mode_t mask)
>  	return ret;
>  }
>  
> -static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error)
> +int mount_bind(const char *root, const char *path, int readonly, int error)
>  {
> -	const char *p = path;
>  	struct stat s;
> -	char old[256];
> -	char new[256];
> +	char new[PATH_MAX];
>  	int fd;
>  
> -	if (strstr(p, "local"))
> -		p = "/lib";
> -
> -	snprintf(old, sizeof(old), "%s/%s", path, name);
> -	snprintf(new, sizeof(new), "%s%s", root, p);
> -
> -	mkdir_p(new, 0755);
> -
> -	snprintf(new, sizeof(new), "%s%s/%s", root, p, name);
> -
> -	if (stat(old, &s)) {
> -		ERROR("%s does not exist\n", old);
> +	if (stat(path, &s)) {
> +		ERROR("stat(%s) failed: %s\n", path, strerror(errno));
>  		return error;
>  	}
>  
> +	snprintf(new, sizeof(new), "%s%s", root, path);
>  	if (S_ISDIR(s.st_mode)) {
>  		mkdir_p(new, 0755);
>  	} else {
> +		mkdir_p(dirname(new), 0755);
> +
> +		snprintf(new, sizeof(new), "%s%s", root, path);
>  		fd = creat(new, 0644);
>  		if (fd == -1) {
> -			ERROR("failed to create %s: %s\n", new, strerror(errno));
> +			ERROR("creat(%s) failed: %s\n", new, strerror(errno));
>  			return -1;
>  		}
>  		close(fd);
>  	}
>  
> -	if (mount(old, new, NULL, MS_BIND, NULL)) {
> -		ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno));
> +	if (mount(path, new, NULL, MS_BIND, NULL)) {
> +		ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno));
>  		return -1;
>  	}
>  
> @@ -133,16 +116,14 @@ static int mount_bind(const char *root, const char *path, const char *name, int
>  		return -1;
>  	}
>  
> -	DEBUG("mount -B %s %s\n", old, new);
> +	DEBUG("mount -B %s %s\n", path, new);
>  
>  	return 0;
>  }
>  
> +#define PRELOAD_SECCOMP "/lib/libpreload-seccomp.so"
>  static int build_jail_fs()
>  {
> -	struct library *l;
> -	struct extra *m;
> -
>  	if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) {
>  		ERROR("tmpfs mount failed %s\n", strerror(errno));
>  		return -1;
> @@ -153,29 +134,20 @@ static int build_jail_fs()
>  		return -1;
>  	}
>  
> -	avl_init(&libraries, avl_strcmp, false, NULL);
> -	alloc_library_path("/lib64");
> -	alloc_library_path("/lib");
> -	alloc_library_path("/usr/lib");
> -	load_ldso_conf("/etc/ld.so.conf");
> +	add_mount_if_exists("/etc/ld.so.conf", 1, -1);
>  
> -	if (elf_load_deps(*opts.jail_argv)) {
> +	if (add_path_and_deps(*opts.jail_argv, 1, -1)) {
>  		ERROR("failed to load dependencies\n");
>  		return -1;
>  	}
>  
> -	if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {
> +	if (opts.seccomp && add_path_and_deps(PRELOAD_SECCOMP, 1, -1) == -1) {
>  		ERROR("failed to load libpreload-seccomp.so\n");
>  		return -1;
>  	}
>  
> -	avl_for_each_element(&libraries, l, avl)
> -		if (mount_bind(opts.path, l->path, l->name, 1, -1))
> -			return -1;
> -
> -	list_for_each_entry(m, &extras, list)
> -		if (mount_bind(opts.path, m->path, m->name, m->readonly, 0))
> -			return -1;
> +	if (mount_all(opts.path))
> +		return -1;
>  
>  	char *mpoint;
>  	if (asprintf(&mpoint, "%s/old", opts.path) < 0) {
> @@ -205,24 +177,19 @@ static int build_jail_fs()
>  	return 0;
>  }
>  
> -#define MAX_ENVP	8
> +#define MAX_ENVP	4
> +#define LD_PRELOAD_SECCOMP "LD_PRELOAD=" PRELOAD_SECCOMP
>  static char** build_envp(const char *seccomp)
>  {
>  	static char *envp[MAX_ENVP];
> -	static char preload_var[64];
> -	static char seccomp_var[64];
> +	static char seccomp_var[PATH_MAX];
> +	static char preload_var[] = LD_PRELOAD_SECCOMP;
>  	static char debug_var[] = "LD_DEBUG=all";
> -	char *preload_lib = find_lib("libpreload-seccomp.so");
>  	int count = 0;
>  
> -	if (seccomp && !preload_lib) {
> -		ERROR("failed to add preload-lib to env\n");
> -		return NULL;
> -	}
>  	if (seccomp) {
>  		snprintf(seccomp_var, sizeof(seccomp_var), "SECCOMP_FILE=%s", seccomp);
>  		envp[count++] = seccomp_var;
> -		snprintf(preload_var, sizeof(preload_var), "LD_PRELOAD=%s", preload_lib);
>  		envp[count++] = preload_var;
>  	}
>  	if (debug > 1)
> @@ -279,7 +246,7 @@ static int spawn_jail()
>  	}
>  
>  	if (build_jail_fs()) {
> -		ERROR("failed to build jail fs");
> +		ERROR("failed to build jail fs\n");
>  		exit(EXIT_FAILURE);
>  	}
>  
> @@ -306,24 +273,6 @@ static struct uloop_process jail_process = {
>  	.cb = jail_process_handler,
>  };
>  
> -static void add_extra(char *name, int readonly)
> -{
> -	struct extra *f;
> -
> -	if (*name != '/') {
> -		ERROR("%s is not an absolute path\n", name);
> -		return;
> -	}
> -
> -	f = calloc(1, sizeof(struct extra));
> -
> -	f->name = basename(name);
> -	f->path = dirname(strdup(name));
> -	f->readonly = readonly;
> -
> -	list_add_tail(&f->list, &extras);
> -}
> -
>  int main(int argc, char **argv)
>  {
>  	uid_t uid = getuid();
> @@ -338,6 +287,7 @@ int main(int argc, char **argv)
>  	}
>  
>  	umask(022);
> +	mount_list_init();
>  
>  	while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
>  		switch (ch) {
> @@ -358,11 +308,11 @@ int main(int argc, char **argv)
>  			break;
>  		case 'S':
>  			opts.seccomp = optarg;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, -1);
>  			break;
>  		case 'C':
>  			opts.capabilities = optarg;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, -1);
>  			break;
>  		case 'P':
>  			opts.namespace = 1;
> @@ -373,19 +323,19 @@ int main(int argc, char **argv)
>  			break;
>  		case 'r':
>  			opts.namespace = 1;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, 0);
>  			break;
>  		case 'w':
>  			opts.namespace = 1;
> -			add_extra(optarg, 0);
> +			add_path_and_deps(optarg, 0, 0);
>  			break;
>  		case 'u':
>  			opts.namespace = 1;
> -			add_extra(ubus, 0);
> +			add_path_and_deps(ubus, 0, -1);
>  			break;
>  		case 'l':
>  			opts.namespace = 1;
> -			add_extra(log, 0);
> +			add_path_and_deps(log, 0, -1);
>  			break;
>  		}
>  	}
> diff --git a/jail/jail.h b/jail/jail.h
> new file mode 100644
> index 0000000..fc69ef6
> --- /dev/null
> +++ b/jail/jail.h
> @@ -0,0 +1,18 @@
> +/*
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#ifndef _JAIL_H__
> +
> +int mount_bind(const char *root, const char *path, int readonly, int error);
> +
> +#endif
>

On 21/11/2015 00:05, Etienne CHAMPETIER wrote:
> Using ldd (via popen()) is a hack, but it's simpler (and working)

indeed

> we have 3 libc and many archs, too many ways to resolve .so
where does it break ?


> Current code:
> -do not parse the intepreter (PT_INTERP) part of the elf
why should it ?

> -do not get the library path priority right (/lib64 is before /lib,
> musl take the libs in /lib even on 64bits images)

libc dependent and not procd depended

> -do not handle RPATH
> 
> This patch:
> -use ldd to detect ELF dependencies
> -add support for shell script

elaborate that please


> uClibc ldd doesn't work with shared lib, thus this patch break
> seccomp with uClibc

so after you patch we can never again update procd in CC ?

	John

> 
> Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
> ---
>  CMakeLists.txt |   2 +-
>  jail/deps.c    | 198 ++++++++++++++++++++++++++++++++
>  jail/deps.h    |  23 ++++
>  jail/elf.c     | 355 ---------------------------------------------------------
>  jail/elf.h     |  38 ------
>  jail/jail.c    | 138 +++++++---------------
>  jail/jail.h    |  18 +++
>  7 files changed, 284 insertions(+), 488 deletions(-)
>  create mode 100644 jail/deps.c
>  create mode 100644 jail/deps.h
>  delete mode 100644 jail/elf.c
>  delete mode 100644 jail/elf.h
>  create mode 100644 jail/jail.h
> 
> diff --git a/CMakeLists.txt b/CMakeLists.txt
> index d749c25..8e3f7ea 100644
> --- a/CMakeLists.txt
> +++ b/CMakeLists.txt
> @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)
>  endif()
>  
>  IF(JAIL_SUPPORT)
> -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)
> +ADD_EXECUTABLE(ujail jail/jail.c jail/deps.c jail/capabilities.c)
>  TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)
>  INSTALL(TARGETS ujail
>  	RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
> diff --git a/jail/deps.c b/jail/deps.c
> new file mode 100644
> index 0000000..0141cef
> --- /dev/null
> +++ b/jail/deps.c
> @@ -0,0 +1,198 @@
> +/*
> + * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#define _GNU_SOURCE
> +
> +#include <assert.h>
> +#include <elf.h>
> +#include <errno.h>
> +#include <fcntl.h>
> +#include <libgen.h>
> +#include <linux/limits.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/mount.h>
> +#include <sys/stat.h>
> +#include <sys/types.h>
> +#include <unistd.h>
> +
> +#include <libubox/avl.h>
> +#include <libubox/avl-cmp.h>
> +
> +#include "deps.h"
> +#include "log.h"
> +#include "jail.h"
> +
> +struct mount {
> +        struct avl_node avl;
> +        const char *path;
> +        int readonly;
> +        int error;
> +};
> +
> +struct avl_tree mounts;
> +
> +static int add_mount(const char *path, int readonly, int error)
> +{
> +	if (avl_find(&mounts, path))
> +		return 1;
> +
> +	struct mount *m;
> +	m = calloc(1, sizeof(struct mount));
> +	assert(m != NULL);
> +	m->avl.key = m->path = strdup(path);
> +	m->readonly = readonly;
> +	m->error = error;
> +
> +	avl_insert(&mounts, &m->avl);
> +	DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly, m->error != 0);
> +	return 0;
> +}
> +
> +int add_mount_if_exists(const char *path, int readonly, int error) {
> +	struct stat s;
> +	if (stat(path, &s) == -1) {
> +		DEBUG("%s doesn't exist\n", path);
> +		return -1;
> +	}
> +	return add_mount(path, readonly, error);
> +}
> +
> +int mount_all(const char *jailroot) {
> +	struct mount *m;
> +	avl_for_each_element(&mounts, m, avl)
> +		if (mount_bind(jailroot, m->path, m->readonly, m->error))
> +			return -1;
> +
> +	return 0;
> +}
> +
> +void mount_list_init() {
> +	avl_init(&mounts, avl_strcmp, false, NULL);
> +}
> +
> +//we already read 2 char from f (#!)
> +static int add_script_deps(FILE *f, const char *path, int readonly, int error)
> +{
> +	char buf[PATH_MAX];
> +	int i = 0;
> +	int c;
> +	while ((c = fgetc(f)) != EOF) {
> +		if (i == 0 && c != '/')
> +			continue;
> +		if (c <= 0x20 || c > 0x7e)
> +			break;
> +		buf[i] = c;
> +		i++;
> +		if (i >= sizeof(buf)) {
> +			ERROR("script interpretor too long (%s)\n", path);
> +			return -1;
> +		}
> +	}
> +	buf[i] = '\0';
> +	return add_path_and_deps(buf, readonly, error);
> +}
> +
> +static int add_elf_deps(const char *path, int readonly, int error)
> +{
> +	char buf[PATH_MAX];
> +	int nb = snprintf(buf, sizeof(buf), "ldd %s", path);
> +	assert(nb >= 0);
> +
> +	FILE *f = popen(buf, "r");
> +	char c;
> +	int i = 0;
> +	while (((c = fgetc(f)) != EOF)) {
> +		if (i == 0 && c != '/') {
> +			continue;
> +		} else if (i > 0 && (c <= ' ' || c > '~')) {
> +			buf[i] = '\0';
> +			add_mount(buf, readonly, error);
> +			i = 0;
> +		} else if (i > 0 || c == '/') {
> +			buf[i] = c;
> +			i++;
> +		}
> +
> +		if (i >= sizeof(buf)) {
> +			ERROR("shared lib too long (%s)\n", path);
> +			return -1;
> +		}
> +	}
> +	pclose(f);
> +	return 0;
> +}
> +
> +int add_path_and_deps(const char *path, int readonly, int error)
> +{
> +	assert(path != NULL);
> +
> +	if (path[0] != '/') {
> +		ERROR("only absolute path are supported (%s)\n", path);
> +		return error;
> +	}
> +
> +	struct stat s;
> +	if (stat(path, &s) == -1) {
> +		ERROR("stat(%s) failed: %s\n", path, strerror(errno));
> +		return error;
> +	}
> +
> +	//path already in list
> +	if (add_mount(path, readonly, error) == 1)
> +		return 0;
> +
> +	if (!S_ISREG(s.st_mode))
> +		return 0;
> +
> +	//too small to be an ELF or a script
> +	if (s.st_size < 4)
> +		return 0;
> +
> +	FILE *f;
> +	if ((f = fopen(path, "r")) == NULL) {
> +		ERROR("fopen(%s) failed: %s\n", path, strerror(errno));
> +		return error;
> +	}
> +
> +	int ret = 0;
> +	int c = fgetc(f);
> +	switch(c) {
> +	//script ?
> +	case '#':
> +		c = fgetc(f);
> +		if (c != '!') {
> +			goto out;
> +		}
> +		//this is a script
> +		ret = add_script_deps(f, path, readonly, error);
> +		goto out;
> +	//elf ?
> +	case ELFMAG0:
> +		if ((c = fgetc(f)) != ELFMAG1
> +			|| (c = fgetc(f)) != ELFMAG2
> +			|| (c = fgetc(f)) != ELFMAG3) {
> +			goto out;
> +		}
> +		ret = add_elf_deps(path, readonly, error);
> +		goto out;
> +	}
> +out:
> +	if (f != NULL)
> +		fclose(f);
> +
> +	return ret;
> +}
> +
> diff --git a/jail/deps.h b/jail/deps.h
> new file mode 100644
> index 0000000..da2a914
> --- /dev/null
> +++ b/jail/deps.h
> @@ -0,0 +1,23 @@
> +/*
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#ifndef _DEPS_H__
> +
> +#include "log.h"
> +
> +int add_mount_if_exists(const char *path, int readonly, int error);
> +int add_path_and_deps(const char *path, int readonly, int error);
> +int mount_all(const char *jailroot);
> +void mount_list_init();
> +
> +#endif
> diff --git a/jail/elf.c b/jail/elf.c
> deleted file mode 100644
> index cbb3051..0000000
> --- a/jail/elf.c
> +++ /dev/null
> @@ -1,355 +0,0 @@
> -/*
> - * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> - *
> - * This program is free software; you can redistribute it and/or modify
> - * it under the terms of the GNU Lesser General Public License version 2.1
> - * as published by the Free Software Foundation
> - *
> - * This program is distributed in the hope that it will be useful,
> - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> - * GNU General Public License for more details.
> - */
> -
> -#define _GNU_SOURCE
> -#include <sys/mman.h>
> -
> -#include <stdlib.h>
> -#include <unistd.h>
> -#include <stdio.h>
> -#include <string.h>
> -#include <sys/stat.h>
> -#include <fcntl.h>
> -#include <libgen.h>
> -#include <glob.h>
> -#include <elf.h>
> -
> -#include <libubox/utils.h>
> -
> -#include "elf.h"
> -
> -struct avl_tree libraries;
> -static LIST_HEAD(library_paths);
> -
> -void alloc_library_path(const char *path)
> -{
> -	struct library_path *p;
> -	char *_path;
> -
> -	p = calloc_a(sizeof(*p),
> -		&_path, strlen(path) + 1);
> -	if (!p)
> -		return;
> -
> -	p->path = strcpy(_path, path);
> -
> -	list_add_tail(&p->list, &library_paths);
> -	DEBUG("adding ld.so path %s\n", path);
> -}
> -
> -static void alloc_library(const char *path, const char *name)
> -{
> -	struct library *l;
> -	char *_name, *_path;
> -
> -	l = calloc_a(sizeof(*l),
> -		&_path, strlen(path) + 1,
> -		&_name, strlen(name) + 1);
> -	if (!l)
> -		return;
> -
> -	l->avl.key = l->name = strcpy(_name, name);
> -	l->path = strcpy(_path, path);
> -
> -	avl_insert(&libraries, &l->avl);
> -	DEBUG("adding library %s/%s\n", path, name);
> -}
> -
> -static int elf_open(char **dir, char *file)
> -{
> -	struct library_path *p;
> -	char path[256];
> -	int fd = -1;
> -
> -	*dir = NULL;
> -
> -	list_for_each_entry(p, &library_paths, list) {
> -		if (strlen(p->path))
> -			snprintf(path, sizeof(path), "%s/%s", p->path, file);
> -		else
> -			strncpy(path, file, sizeof(path));
> -		fd = open(path, O_RDONLY);
> -		if (fd >= 0) {
> -			*dir = p->path;
> -			break;
> -		}
> -	}
> -
> -	if (fd == -1)
> -		fd = open(file, O_RDONLY);
> -
> -	return fd;
> -}
> -
> -char* find_lib(char *file)
> -{
> -	struct library *l;
> -	static char path[256];
> -	const char *p;
> -
> -	l = avl_find_element(&libraries, file, l, avl);
> -	if (!l)
> -		return NULL;
> -
> -	p = l->path;
> -	if (strstr(p, "local"))
> -		p = "/lib";
> -
> -	snprintf(path, sizeof(path), "%s/%s", p, file);
> -
> -	return path;
> -}
> -
> -static int elf64_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
> -{
> -	Elf64_Ehdr *e;
> -	Elf64_Phdr *ph;
> -	int i;
> -
> -	e = (Elf64_Ehdr *) map;
> -	ph = (Elf64_Phdr *) (map + e->e_phoff);
> -
> -	for (i = 0; i < e->e_phnum; i++) {
> -		if (ph[i].p_type == type) {
> -			*offset = ph[i].p_offset;
> -			if (size)
> -				*size = ph[i].p_filesz;
> -			if (vaddr)
> -				*vaddr = ph[i].p_vaddr;
> -			return 0;
> -		}
> -	}
> -
> -	return -1;
> -}
> -
> -static int elf32_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
> -{
> -	Elf32_Ehdr *e;
> -	Elf32_Phdr *ph;
> -	int i;
> -
> -	e = (Elf32_Ehdr *) map;
> -	ph = (Elf32_Phdr *) (map + e->e_phoff);
> -
> -	for (i = 0; i < e->e_phnum; i++) {
> -		if (ph[i].p_type == type) {
> -			*offset = ph[i].p_offset;
> -			if (size)
> -				*size = ph[i].p_filesz;
> -			if (vaddr)
> -				*vaddr = ph[i].p_vaddr;
> -			return 0;
> -		}
> -	}
> -
> -	return -1;
> -}
> -
> -static int elf_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
> -{
> -	int clazz = map[EI_CLASS];
> -
> -	if (clazz == ELFCLASS32)
> -		return elf32_find_section(map, type, offset, size, vaddr);
> -	else if (clazz == ELFCLASS64)
> -		return elf64_find_section(map, type, offset, size, vaddr);
> -
> -	ERROR("unknown elf format %d\n", clazz);
> -
> -	return -1;
> -}
> -
> -static int elf32_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)
> -{
> -	Elf32_Dyn *dynamic = (Elf32_Dyn *) (map + dyn_offset);
> -	char *strtab = NULL;
> -
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf32_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_STRTAB)
> -			continue;
> -
> -		strtab = map + (curr->d_un.d_val - load_offset);
> -		break;
> -	}
> -
> -	if (!strtab)
> -		return -1;
> -
> -	dynamic = (Elf32_Dyn *) (map + dyn_offset);
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf32_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_NEEDED)
> -			continue;
> -
> -		if (elf_load_deps(&strtab[curr->d_un.d_val]))
> -			return -1;
> -	}
> -
> -	return 0;
> -}
> -
> -static int elf64_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)
> -{
> -	Elf64_Dyn *dynamic = (Elf64_Dyn *) (map + dyn_offset);
> -	char *strtab = NULL;
> -
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf64_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_STRTAB)
> -			continue;
> -
> -		strtab = map + (curr->d_un.d_val - load_offset);
> -		break;
> -	}
> -
> -	if (!strtab)
> -		return -1;
> -
> -	dynamic = (Elf64_Dyn *) (map + dyn_offset);
> -	while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> -		Elf64_Dyn *curr = dynamic;
> -
> -		dynamic++;
> -		if (curr->d_tag != DT_NEEDED)
> -			continue;
> -
> -		if (elf_load_deps(&strtab[curr->d_un.d_val]))
> -			return -1;
> -	}
> -
> -	return 0;
> -}
> -
> -int elf_load_deps(char *library)
> -{
> -	unsigned int dyn_offset, dyn_size;
> -	unsigned int load_offset, load_vaddr;
> -	struct stat s;
> -	char *map = NULL, *dir = NULL;
> -	int clazz, fd, ret = -1;
> -
> -	if (avl_find(&libraries, library))
> -		return 0;
> -
> -	fd = elf_open(&dir, library);
> -
> -	if (fd < 0) {
> -		ERROR("failed to open %s\n", library);
> -		return -1;
> -	}
> -
> -	if (fstat(fd, &s) == -1) {
> -		ERROR("failed to stat %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
> -	if (map == MAP_FAILED) {
> -		ERROR("failed to mmap %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	if (elf_find_section(map, PT_LOAD, &load_offset, NULL, &load_vaddr)) {
> -		ERROR("failed to load the .load section from %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size, NULL)) {
> -		ERROR("failed to load the .dynamic section from %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	if (dir) {
> -		alloc_library(dir, library);
> -	} else {
> -		char *elf = strdup(library);
> -
> -		alloc_library(dirname(elf), basename(library));
> -		free(elf);
> -	}
> -	clazz = map[EI_CLASS];
> -
> -	if (clazz == ELFCLASS32)
> -		ret = elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
> -	else if (clazz == ELFCLASS64)
> -		ret = elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
> -
> -err_out:
> -	if (map)
> -		munmap(map, s.st_size);
> -	close(fd);
> -
> -	return ret;
> -}
> -
> -void load_ldso_conf(const char *conf)
> -{
> -	FILE* fp = fopen(conf, "r");
> -	char line[256];
> -
> -	if (!fp) {
> -		DEBUG("failed to open %s\n", conf);
> -		return;
> -	}
> -
> -	while (!feof(fp)) {
> -		int len;
> -
> -		if (!fgets(line, 256, fp))
> -			break;
> -		len = strlen(line);
> -		if (len < 2)
> -			continue;
> -		if (*line == '#')
> -			continue;
> -		if (line[len - 1] == '\n')
> -			line[len - 1] = '\0';
> -		if (!strncmp(line, "include ", 8)) {
> -			char *sep = strstr(line, " ");
> -			glob_t gl;
> -			int i;
> -
> -			if (!sep)
> -				continue;;
> -			while (*sep == ' ')
> -				sep++;
> -			if (glob(sep, GLOB_NOESCAPE | GLOB_MARK, NULL, &gl)) {
> -				ERROR("glob failed on %s\n", sep);
> -				continue;
> -			}
> -			for (i = 0; i < gl.gl_pathc; i++)
> -				load_ldso_conf(gl.gl_pathv[i]);
> -			globfree(&gl);
> -		} else {
> -			struct stat s;
> -
> -			if (stat(line, &s))
> -				continue;
> -			alloc_library_path(line);
> -		}
> -	}
> -
> -	fclose(fp);
> -}
> diff --git a/jail/elf.h b/jail/elf.h
> deleted file mode 100644
> index 3ae311e..0000000
> --- a/jail/elf.h
> +++ /dev/null
> @@ -1,38 +0,0 @@
> -/*
> - * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> - *
> - * This program is free software; you can redistribute it and/or modify
> - * it under the terms of the GNU Lesser General Public License version 2.1
> - * as published by the Free Software Foundation
> - *
> - * This program is distributed in the hope that it will be useful,
> - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> - * GNU General Public License for more details.
> - */
> -
> -#ifndef _ELF_H__
> -#include <libubox/avl.h>
> -#include <libubox/avl-cmp.h>
> -
> -#include "log.h"
> -
> -struct library {
> -	struct avl_node avl;
> -	char *name;
> -	char *path;
> -};
> -
> -struct library_path {
> -	struct list_head list;
> -	char *path;
> -};
> -
> -extern struct avl_tree libraries;
> -
> -extern void alloc_library_path(const char *path);
> -extern char* find_lib(char *file);
> -extern int elf_load_deps(char *library);
> -extern void load_ldso_conf(const char *conf);
> -
> -#endif
> diff --git a/jail/jail.c b/jail/jail.c
> index 08babde..391c196 100644
> --- a/jail/jail.c
> +++ b/jail/jail.c
> @@ -12,27 +12,28 @@
>   */
>  
>  #define _GNU_SOURCE
> -#include <sys/mount.h>
> -#include <sys/prctl.h>
> -#include <sys/wait.h>
>  
> -#include <stdlib.h>
> -#include <unistd.h>
> -#include <values.h>
>  #include <errno.h>
> -#include <stdio.h>
> -#include <string.h>
> -#include <sys/stat.h>
>  #include <fcntl.h>
>  #include <libgen.h>
> +#include <linux/limits.h>
>  #include <sched.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/mount.h>
> +#include <sys/prctl.h>
> +#include <sys/stat.h>
> +#include <sys/wait.h>
> +#include <unistd.h>
>  
> -#include "elf.h"
> -#include "capabilities.h"
> -
> -#include <libubox/list.h>
>  #include <libubox/uloop.h>
>  
> +#include "capabilities.h"
> +#include "deps.h"
> +#include "jail.h"
> +#include "log.h"
> +
>  #define STACK_SIZE	(1024 * 1024)
>  #define OPT_ARGS	"P:S:C:n:r:w:d:psulo"
>  
> @@ -48,16 +49,6 @@ static struct {
>  	int sysfs;
>  } opts;
>  
> -struct extra {
> -	struct list_head list;
> -
> -	const char *path;
> -	const char *name;
> -	int readonly;
> -};
> -
> -static LIST_HEAD(extras);
> -
>  extern int pivot_root(const char *new_root, const char *put_old);
>  
>  int debug = 0;
> @@ -89,42 +80,34 @@ static int mkdir_p(char *dir, mode_t mask)
>  	return ret;
>  }
>  
> -static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error)
> +int mount_bind(const char *root, const char *path, int readonly, int error)
>  {
> -	const char *p = path;
>  	struct stat s;
> -	char old[256];
> -	char new[256];
> +	char new[PATH_MAX];
>  	int fd;
>  
> -	if (strstr(p, "local"))
> -		p = "/lib";
> -
> -	snprintf(old, sizeof(old), "%s/%s", path, name);
> -	snprintf(new, sizeof(new), "%s%s", root, p);
> -
> -	mkdir_p(new, 0755);
> -
> -	snprintf(new, sizeof(new), "%s%s/%s", root, p, name);
> -
> -	if (stat(old, &s)) {
> -		ERROR("%s does not exist\n", old);
> +	if (stat(path, &s)) {
> +		ERROR("stat(%s) failed: %s\n", path, strerror(errno));
>  		return error;
>  	}
>  
> +	snprintf(new, sizeof(new), "%s%s", root, path);
>  	if (S_ISDIR(s.st_mode)) {
>  		mkdir_p(new, 0755);
>  	} else {
> +		mkdir_p(dirname(new), 0755);
> +
> +		snprintf(new, sizeof(new), "%s%s", root, path);
>  		fd = creat(new, 0644);
>  		if (fd == -1) {
> -			ERROR("failed to create %s: %s\n", new, strerror(errno));
> +			ERROR("creat(%s) failed: %s\n", new, strerror(errno));
>  			return -1;
>  		}
>  		close(fd);
>  	}
>  
> -	if (mount(old, new, NULL, MS_BIND, NULL)) {
> -		ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno));
> +	if (mount(path, new, NULL, MS_BIND, NULL)) {
> +		ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno));
>  		return -1;
>  	}
>  
> @@ -133,16 +116,14 @@ static int mount_bind(const char *root, const char *path, const char *name, int
>  		return -1;
>  	}
>  
> -	DEBUG("mount -B %s %s\n", old, new);
> +	DEBUG("mount -B %s %s\n", path, new);
>  
>  	return 0;
>  }
>  
> +#define PRELOAD_SECCOMP "/lib/libpreload-seccomp.so"
>  static int build_jail_fs()
>  {
> -	struct library *l;
> -	struct extra *m;
> -
>  	if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) {
>  		ERROR("tmpfs mount failed %s\n", strerror(errno));
>  		return -1;
> @@ -153,29 +134,20 @@ static int build_jail_fs()
>  		return -1;
>  	}
>  
> -	avl_init(&libraries, avl_strcmp, false, NULL);
> -	alloc_library_path("/lib64");
> -	alloc_library_path("/lib");
> -	alloc_library_path("/usr/lib");
> -	load_ldso_conf("/etc/ld.so.conf");
> +	add_mount_if_exists("/etc/ld.so.conf", 1, -1);
>  
> -	if (elf_load_deps(*opts.jail_argv)) {
> +	if (add_path_and_deps(*opts.jail_argv, 1, -1)) {
>  		ERROR("failed to load dependencies\n");
>  		return -1;
>  	}
>  
> -	if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {
> +	if (opts.seccomp && add_path_and_deps(PRELOAD_SECCOMP, 1, -1) == -1) {
>  		ERROR("failed to load libpreload-seccomp.so\n");
>  		return -1;
>  	}
>  
> -	avl_for_each_element(&libraries, l, avl)
> -		if (mount_bind(opts.path, l->path, l->name, 1, -1))
> -			return -1;
> -
> -	list_for_each_entry(m, &extras, list)
> -		if (mount_bind(opts.path, m->path, m->name, m->readonly, 0))
> -			return -1;
> +	if (mount_all(opts.path))
> +		return -1;
>  
>  	char *mpoint;
>  	if (asprintf(&mpoint, "%s/old", opts.path) < 0) {
> @@ -205,24 +177,19 @@ static int build_jail_fs()
>  	return 0;
>  }
>  
> -#define MAX_ENVP	8
> +#define MAX_ENVP	4
> +#define LD_PRELOAD_SECCOMP "LD_PRELOAD=" PRELOAD_SECCOMP
>  static char** build_envp(const char *seccomp)
>  {
>  	static char *envp[MAX_ENVP];
> -	static char preload_var[64];
> -	static char seccomp_var[64];
> +	static char seccomp_var[PATH_MAX];
> +	static char preload_var[] = LD_PRELOAD_SECCOMP;
>  	static char debug_var[] = "LD_DEBUG=all";
> -	char *preload_lib = find_lib("libpreload-seccomp.so");
>  	int count = 0;
>  
> -	if (seccomp && !preload_lib) {
> -		ERROR("failed to add preload-lib to env\n");
> -		return NULL;
> -	}
>  	if (seccomp) {
>  		snprintf(seccomp_var, sizeof(seccomp_var), "SECCOMP_FILE=%s", seccomp);
>  		envp[count++] = seccomp_var;
> -		snprintf(preload_var, sizeof(preload_var), "LD_PRELOAD=%s", preload_lib);
>  		envp[count++] = preload_var;
>  	}
>  	if (debug > 1)
> @@ -279,7 +246,7 @@ static int spawn_jail()
>  	}
>  
>  	if (build_jail_fs()) {
> -		ERROR("failed to build jail fs");
> +		ERROR("failed to build jail fs\n");
>  		exit(EXIT_FAILURE);
>  	}
>  
> @@ -306,24 +273,6 @@ static struct uloop_process jail_process = {
>  	.cb = jail_process_handler,
>  };
>  
> -static void add_extra(char *name, int readonly)
> -{
> -	struct extra *f;
> -
> -	if (*name != '/') {
> -		ERROR("%s is not an absolute path\n", name);
> -		return;
> -	}
> -
> -	f = calloc(1, sizeof(struct extra));
> -
> -	f->name = basename(name);
> -	f->path = dirname(strdup(name));
> -	f->readonly = readonly;
> -
> -	list_add_tail(&f->list, &extras);
> -}
> -
>  int main(int argc, char **argv)
>  {
>  	uid_t uid = getuid();
> @@ -338,6 +287,7 @@ int main(int argc, char **argv)
>  	}
>  
>  	umask(022);
> +	mount_list_init();
>  
>  	while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
>  		switch (ch) {
> @@ -358,11 +308,11 @@ int main(int argc, char **argv)
>  			break;
>  		case 'S':
>  			opts.seccomp = optarg;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, -1);
>  			break;
>  		case 'C':
>  			opts.capabilities = optarg;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, -1);
>  			break;
>  		case 'P':
>  			opts.namespace = 1;
> @@ -373,19 +323,19 @@ int main(int argc, char **argv)
>  			break;
>  		case 'r':
>  			opts.namespace = 1;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, 0);
>  			break;
>  		case 'w':
>  			opts.namespace = 1;
> -			add_extra(optarg, 0);
> +			add_path_and_deps(optarg, 0, 0);
>  			break;
>  		case 'u':
>  			opts.namespace = 1;
> -			add_extra(ubus, 0);
> +			add_path_and_deps(ubus, 0, -1);
>  			break;
>  		case 'l':
>  			opts.namespace = 1;
> -			add_extra(log, 0);
> +			add_path_and_deps(log, 0, -1);
>  			break;
>  		}
>  	}
> diff --git a/jail/jail.h b/jail/jail.h
> new file mode 100644
> index 0000000..fc69ef6
> --- /dev/null
> +++ b/jail/jail.h
> @@ -0,0 +1,18 @@
> +/*
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#ifndef _JAIL_H__
> +
> +int mount_bind(const char *root, const char *path, int readonly, int error);
> +
> +#endif
>

Hi,

first sorry, i've forgot to add the ticket reference
https://dev.openwrt.org/ticket/20785

also full disclore, I'm only writing C for OpenWrt
so is there a compilation flag to disable C++,
or can you be more specific on what C++ ism i'm using ?

2015-11-21 9:08 GMT+01:00 John Crispin <john@phrozen.org>:

>
>
> On 21/11/2015 00:05, Etienne CHAMPETIER wrote:
> > Using ldd (via popen()) is a hack, but it's simpler (and working)
>
> indeed
>
> > we have 3 libc and many archs, too many ways to resolve .so
> where does it break ?
>
>
> > Current code:
> > -do not parse the intepreter (PT_INTERP) part of the elf
> why should it ?
>


here is the output of "objdump -x -s" on /bin/cat (subtarget x86_64 / DD)

> Dynamic Section:
>   NEEDED               libgcc_s.so.1
>   NEEDED               libc.so
> Contents of section .interp:
>  /lib/ld-musl-x86_64.so.1
>
> and the output of ldd /bin/cat

> root@OpenWrt:/# ldd /bin/cat
>     /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)
>     libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7fbe78371000)
>     libc.so => /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)
>

if you run "ujail -d1 -p -- /bin/cat /proc/self/mounts"
the execve() call fail with "ENOENT (No such file or directory)"

now if you add "/lib/ld-musl-x86_64.so.1" to the jail (-r), and you remove
symlink
from /lib64 to /lib, it works

the good question is why does it fails with musl/DD and work with uclibc/CC
and glibc?


> > -do not get the library path priority right (/lib64 is before /lib,
> > musl take the libs in /lib even on 64bits images)
>
> libc dependent and not procd depended
>

ujail has to resolve the same libs as the libc does,
so it depends on the libc, but it's still a ujail problem
that was my main motivation to use ldd


> > -do not handle RPATH
> >
> > This patch:
> > -use ldd to detect ELF dependencies
> > -add support for shell script
>
> elaborate that please
>

if the file start with #!, add the exec and it dependencies to the jail


>
>
> > uClibc ldd doesn't work with shared lib, thus this patch break
> > seccomp with uClibc
>
> so after you patch we can never again update procd in CC ?
>

yes

i will try to improve the current elf parsing code,
but i'm afraid that it will break depending on the arch and ...


>
>         John
>
> >
> > Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
> > ---
> >  CMakeLists.txt |   2 +-
> >  jail/deps.c    | 198 ++++++++++++++++++++++++++++++++
> >  jail/deps.h    |  23 ++++
> >  jail/elf.c     | 355
> ---------------------------------------------------------
> >  jail/elf.h     |  38 ------
> >  jail/jail.c    | 138 +++++++---------------
> >  jail/jail.h    |  18 +++
> >  7 files changed, 284 insertions(+), 488 deletions(-)
> >  create mode 100644 jail/deps.c
> >  create mode 100644 jail/deps.h
> >  delete mode 100644 jail/elf.c
> >  delete mode 100644 jail/elf.h
> >  create mode 100644 jail/jail.h
> >
> > diff --git a/CMakeLists.txt b/CMakeLists.txt
> > index d749c25..8e3f7ea 100644
> > --- a/CMakeLists.txt
> > +++ b/CMakeLists.txt
> > @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)
> >  endif()
> >
> >  IF(JAIL_SUPPORT)
> > -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)
> > +ADD_EXECUTABLE(ujail jail/jail.c jail/deps.c jail/capabilities.c)
> >  TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)
> >  INSTALL(TARGETS ujail
> >       RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
> > diff --git a/jail/deps.c b/jail/deps.c
> > new file mode 100644
> > index 0000000..0141cef
> > --- /dev/null
> > +++ b/jail/deps.c
> > @@ -0,0 +1,198 @@
> > +/*
> > + * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> > + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU Lesser General Public License version
> 2.1
> > + * as published by the Free Software Foundation
> > + *
> > + * This program is distributed in the hope that it will be useful,
> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> > + * GNU General Public License for more details.
> > + */
> > +
> > +#define _GNU_SOURCE
> > +
> > +#include <assert.h>
> > +#include <elf.h>
> > +#include <errno.h>
> > +#include <fcntl.h>
> > +#include <libgen.h>
> > +#include <linux/limits.h>
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <sys/mount.h>
> > +#include <sys/stat.h>
> > +#include <sys/types.h>
> > +#include <unistd.h>
> > +
> > +#include <libubox/avl.h>
> > +#include <libubox/avl-cmp.h>
> > +
> > +#include "deps.h"
> > +#include "log.h"
> > +#include "jail.h"
> > +
> > +struct mount {
> > +        struct avl_node avl;
> > +        const char *path;
> > +        int readonly;
> > +        int error;
> > +};
> > +
> > +struct avl_tree mounts;
> > +
> > +static int add_mount(const char *path, int readonly, int error)
> > +{
> > +     if (avl_find(&mounts, path))
> > +             return 1;
> > +
> > +     struct mount *m;
> > +     m = calloc(1, sizeof(struct mount));
> > +     assert(m != NULL);
> > +     m->avl.key = m->path = strdup(path);
> > +     m->readonly = readonly;
> > +     m->error = error;
> > +
> > +     avl_insert(&mounts, &m->avl);
> > +     DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly,
> m->error != 0);
> > +     return 0;
> > +}
> > +
> > +int add_mount_if_exists(const char *path, int readonly, int error) {
> > +     struct stat s;
> > +     if (stat(path, &s) == -1) {
> > +             DEBUG("%s doesn't exist\n", path);
> > +             return -1;
> > +     }
> > +     return add_mount(path, readonly, error);
> > +}
> > +
> > +int mount_all(const char *jailroot) {
> > +     struct mount *m;
> > +     avl_for_each_element(&mounts, m, avl)
> > +             if (mount_bind(jailroot, m->path, m->readonly, m->error))
> > +                     return -1;
> > +
> > +     return 0;
> > +}
> > +
> > +void mount_list_init() {
> > +     avl_init(&mounts, avl_strcmp, false, NULL);
> > +}
> > +
> > +//we already read 2 char from f (#!)
> > +static int add_script_deps(FILE *f, const char *path, int readonly, int
> error)
> > +{
> > +     char buf[PATH_MAX];
> > +     int i = 0;
> > +     int c;
> > +     while ((c = fgetc(f)) != EOF) {
> > +             if (i == 0 && c != '/')
> > +                     continue;
> > +             if (c <= 0x20 || c > 0x7e)
> > +                     break;
> > +             buf[i] = c;
> > +             i++;
> > +             if (i >= sizeof(buf)) {
> > +                     ERROR("script interpretor too long (%s)\n", path);
> > +                     return -1;
> > +             }
> > +     }
> > +     buf[i] = '\0';
> > +     return add_path_and_deps(buf, readonly, error);
> > +}
> > +
> > +static int add_elf_deps(const char *path, int readonly, int error)
> > +{
> > +     char buf[PATH_MAX];
> > +     int nb = snprintf(buf, sizeof(buf), "ldd %s", path);
> > +     assert(nb >= 0);
> > +
> > +     FILE *f = popen(buf, "r");
> > +     char c;
> > +     int i = 0;
> > +     while (((c = fgetc(f)) != EOF)) {
> > +             if (i == 0 && c != '/') {
> > +                     continue;
> > +             } else if (i > 0 && (c <= ' ' || c > '~')) {
> > +                     buf[i] = '\0';
> > +                     add_mount(buf, readonly, error);
> > +                     i = 0;
> > +             } else if (i > 0 || c == '/') {
> > +                     buf[i] = c;
> > +                     i++;
> > +             }
> > +
> > +             if (i >= sizeof(buf)) {
> > +                     ERROR("shared lib too long (%s)\n", path);
> > +                     return -1;
> > +             }
> > +     }
> > +     pclose(f);
> > +     return 0;
> > +}
> > +
> > +int add_path_and_deps(const char *path, int readonly, int error)
> > +{
> > +     assert(path != NULL);
> > +
> > +     if (path[0] != '/') {
> > +             ERROR("only absolute path are supported (%s)\n", path);
> > +             return error;
> > +     }
> > +
> > +     struct stat s;
> > +     if (stat(path, &s) == -1) {
> > +             ERROR("stat(%s) failed: %s\n", path, strerror(errno));
> > +             return error;
> > +     }
> > +
> > +     //path already in list
> > +     if (add_mount(path, readonly, error) == 1)
> > +             return 0;
> > +
> > +     if (!S_ISREG(s.st_mode))
> > +             return 0;
> > +
> > +     //too small to be an ELF or a script
> > +     if (s.st_size < 4)
> > +             return 0;
> > +
> > +     FILE *f;
> > +     if ((f = fopen(path, "r")) == NULL) {
> > +             ERROR("fopen(%s) failed: %s\n", path, strerror(errno));
> > +             return error;
> > +     }
> > +
> > +     int ret = 0;
> > +     int c = fgetc(f);
> > +     switch(c) {
> > +     //script ?
> > +     case '#':
> > +             c = fgetc(f);
> > +             if (c != '!') {
> > +                     goto out;
> > +             }
> > +             //this is a script
> > +             ret = add_script_deps(f, path, readonly, error);
> > +             goto out;
> > +     //elf ?
> > +     case ELFMAG0:
> > +             if ((c = fgetc(f)) != ELFMAG1
> > +                     || (c = fgetc(f)) != ELFMAG2
> > +                     || (c = fgetc(f)) != ELFMAG3) {
> > +                     goto out;
> > +             }
> > +             ret = add_elf_deps(path, readonly, error);
> > +             goto out;
> > +     }
> > +out:
> > +     if (f != NULL)
> > +             fclose(f);
> > +
> > +     return ret;
> > +}
> > +
> > diff --git a/jail/deps.h b/jail/deps.h
> > new file mode 100644
> > index 0000000..da2a914
> > --- /dev/null
> > +++ b/jail/deps.h
> > @@ -0,0 +1,23 @@
> > +/*
> > + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU Lesser General Public License version
> 2.1
> > + * as published by the Free Software Foundation
> > + *
> > + * This program is distributed in the hope that it will be useful,
> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> > + * GNU General Public License for more details.
> > + */
> > +
> > +#ifndef _DEPS_H__
> > +
> > +#include "log.h"
> > +
> > +int add_mount_if_exists(const char *path, int readonly, int error);
> > +int add_path_and_deps(const char *path, int readonly, int error);
> > +int mount_all(const char *jailroot);
> > +void mount_list_init();
> > +
> > +#endif
> > diff --git a/jail/elf.c b/jail/elf.c
> > deleted file mode 100644
> > index cbb3051..0000000
> > --- a/jail/elf.c
> > +++ /dev/null
> > @@ -1,355 +0,0 @@
> > -/*
> > - * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> > - *
> > - * This program is free software; you can redistribute it and/or modify
> > - * it under the terms of the GNU Lesser General Public License version
> 2.1
> > - * as published by the Free Software Foundation
> > - *
> > - * This program is distributed in the hope that it will be useful,
> > - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> > - * GNU General Public License for more details.
> > - */
> > -
> > -#define _GNU_SOURCE
> > -#include <sys/mman.h>
> > -
> > -#include <stdlib.h>
> > -#include <unistd.h>
> > -#include <stdio.h>
> > -#include <string.h>
> > -#include <sys/stat.h>
> > -#include <fcntl.h>
> > -#include <libgen.h>
> > -#include <glob.h>
> > -#include <elf.h>
> > -
> > -#include <libubox/utils.h>
> > -
> > -#include "elf.h"
> > -
> > -struct avl_tree libraries;
> > -static LIST_HEAD(library_paths);
> > -
> > -void alloc_library_path(const char *path)
> > -{
> > -     struct library_path *p;
> > -     char *_path;
> > -
> > -     p = calloc_a(sizeof(*p),
> > -             &_path, strlen(path) + 1);
> > -     if (!p)
> > -             return;
> > -
> > -     p->path = strcpy(_path, path);
> > -
> > -     list_add_tail(&p->list, &library_paths);
> > -     DEBUG("adding ld.so path %s\n", path);
> > -}
> > -
> > -static void alloc_library(const char *path, const char *name)
> > -{
> > -     struct library *l;
> > -     char *_name, *_path;
> > -
> > -     l = calloc_a(sizeof(*l),
> > -             &_path, strlen(path) + 1,
> > -             &_name, strlen(name) + 1);
> > -     if (!l)
> > -             return;
> > -
> > -     l->avl.key = l->name = strcpy(_name, name);
> > -     l->path = strcpy(_path, path);
> > -
> > -     avl_insert(&libraries, &l->avl);
> > -     DEBUG("adding library %s/%s\n", path, name);
> > -}
> > -
> > -static int elf_open(char **dir, char *file)
> > -{
> > -     struct library_path *p;
> > -     char path[256];
> > -     int fd = -1;
> > -
> > -     *dir = NULL;
> > -
> > -     list_for_each_entry(p, &library_paths, list) {
> > -             if (strlen(p->path))
> > -                     snprintf(path, sizeof(path), "%s/%s", p->path,
> file);
> > -             else
> > -                     strncpy(path, file, sizeof(path));
> > -             fd = open(path, O_RDONLY);
> > -             if (fd >= 0) {
> > -                     *dir = p->path;
> > -                     break;
> > -             }
> > -     }
> > -
> > -     if (fd == -1)
> > -             fd = open(file, O_RDONLY);
> > -
> > -     return fd;
> > -}
> > -
> > -char* find_lib(char *file)
> > -{
> > -     struct library *l;
> > -     static char path[256];
> > -     const char *p;
> > -
> > -     l = avl_find_element(&libraries, file, l, avl);
> > -     if (!l)
> > -             return NULL;
> > -
> > -     p = l->path;
> > -     if (strstr(p, "local"))
> > -             p = "/lib";
> > -
> > -     snprintf(path, sizeof(path), "%s/%s", p, file);
> > -
> > -     return path;
> > -}
> > -
> > -static int elf64_find_section(char *map, unsigned int type, unsigned
> int *offset, unsigned int *size, unsigned int *vaddr)
> > -{
> > -     Elf64_Ehdr *e;
> > -     Elf64_Phdr *ph;
> > -     int i;
> > -
> > -     e = (Elf64_Ehdr *) map;
> > -     ph = (Elf64_Phdr *) (map + e->e_phoff);
> > -
> > -     for (i = 0; i < e->e_phnum; i++) {
> > -             if (ph[i].p_type == type) {
> > -                     *offset = ph[i].p_offset;
> > -                     if (size)
> > -                             *size = ph[i].p_filesz;
> > -                     if (vaddr)
> > -                             *vaddr = ph[i].p_vaddr;
> > -                     return 0;
> > -             }
> > -     }
> > -
> > -     return -1;
> > -}
> > -
> > -static int elf32_find_section(char *map, unsigned int type, unsigned
> int *offset, unsigned int *size, unsigned int *vaddr)
> > -{
> > -     Elf32_Ehdr *e;
> > -     Elf32_Phdr *ph;
> > -     int i;
> > -
> > -     e = (Elf32_Ehdr *) map;
> > -     ph = (Elf32_Phdr *) (map + e->e_phoff);
> > -
> > -     for (i = 0; i < e->e_phnum; i++) {
> > -             if (ph[i].p_type == type) {
> > -                     *offset = ph[i].p_offset;
> > -                     if (size)
> > -                             *size = ph[i].p_filesz;
> > -                     if (vaddr)
> > -                             *vaddr = ph[i].p_vaddr;
> > -                     return 0;
> > -             }
> > -     }
> > -
> > -     return -1;
> > -}
> > -
> > -static int elf_find_section(char *map, unsigned int type, unsigned int
> *offset, unsigned int *size, unsigned int *vaddr)
> > -{
> > -     int clazz = map[EI_CLASS];
> > -
> > -     if (clazz == ELFCLASS32)
> > -             return elf32_find_section(map, type, offset, size, vaddr);
> > -     else if (clazz == ELFCLASS64)
> > -             return elf64_find_section(map, type, offset, size, vaddr);
> > -
> > -     ERROR("unknown elf format %d\n", clazz);
> > -
> > -     return -1;
> > -}
> > -
> > -static int elf32_scan_dynamic(char *map, int dyn_offset, int dyn_size,
> int load_offset)
> > -{
> > -     Elf32_Dyn *dynamic = (Elf32_Dyn *) (map + dyn_offset);
> > -     char *strtab = NULL;
> > -
> > -     while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > -             Elf32_Dyn *curr = dynamic;
> > -
> > -             dynamic++;
> > -             if (curr->d_tag != DT_STRTAB)
> > -                     continue;
> > -
> > -             strtab = map + (curr->d_un.d_val - load_offset);
> > -             break;
> > -     }
> > -
> > -     if (!strtab)
> > -             return -1;
> > -
> > -     dynamic = (Elf32_Dyn *) (map + dyn_offset);
> > -     while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > -             Elf32_Dyn *curr = dynamic;
> > -
> > -             dynamic++;
> > -             if (curr->d_tag != DT_NEEDED)
> > -                     continue;
> > -
> > -             if (elf_load_deps(&strtab[curr->d_un.d_val]))
> > -                     return -1;
> > -     }
> > -
> > -     return 0;
> > -}
> > -
> > -static int elf64_scan_dynamic(char *map, int dyn_offset, int dyn_size,
> int load_offset)
> > -{
> > -     Elf64_Dyn *dynamic = (Elf64_Dyn *) (map + dyn_offset);
> > -     char *strtab = NULL;
> > -
> > -     while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > -             Elf64_Dyn *curr = dynamic;
> > -
> > -             dynamic++;
> > -             if (curr->d_tag != DT_STRTAB)
> > -                     continue;
> > -
> > -             strtab = map + (curr->d_un.d_val - load_offset);
> > -             break;
> > -     }
> > -
> > -     if (!strtab)
> > -             return -1;
> > -
> > -     dynamic = (Elf64_Dyn *) (map + dyn_offset);
> > -     while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > -             Elf64_Dyn *curr = dynamic;
> > -
> > -             dynamic++;
> > -             if (curr->d_tag != DT_NEEDED)
> > -                     continue;
> > -
> > -             if (elf_load_deps(&strtab[curr->d_un.d_val]))
> > -                     return -1;
> > -     }
> > -
> > -     return 0;
> > -}
> > -
> > -int elf_load_deps(char *library)
> > -{
> > -     unsigned int dyn_offset, dyn_size;
> > -     unsigned int load_offset, load_vaddr;
> > -     struct stat s;
> > -     char *map = NULL, *dir = NULL;
> > -     int clazz, fd, ret = -1;
> > -
> > -     if (avl_find(&libraries, library))
> > -             return 0;
> > -
> > -     fd = elf_open(&dir, library);
> > -
> > -     if (fd < 0) {
> > -             ERROR("failed to open %s\n", library);
> > -             return -1;
> > -     }
> > -
> > -     if (fstat(fd, &s) == -1) {
> > -             ERROR("failed to stat %s\n", library);
> > -             ret = -1;
> > -             goto err_out;
> > -     }
> > -
> > -     map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
> > -     if (map == MAP_FAILED) {
> > -             ERROR("failed to mmap %s\n", library);
> > -             ret = -1;
> > -             goto err_out;
> > -     }
> > -
> > -     if (elf_find_section(map, PT_LOAD, &load_offset, NULL,
> &load_vaddr)) {
> > -             ERROR("failed to load the .load section from %s\n",
> library);
> > -             ret = -1;
> > -             goto err_out;
> > -     }
> > -
> > -     if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size,
> NULL)) {
> > -             ERROR("failed to load the .dynamic section from %s\n",
> library);
> > -             ret = -1;
> > -             goto err_out;
> > -     }
> > -
> > -     if (dir) {
> > -             alloc_library(dir, library);
> > -     } else {
> > -             char *elf = strdup(library);
> > -
> > -             alloc_library(dirname(elf), basename(library));
> > -             free(elf);
> > -     }
> > -     clazz = map[EI_CLASS];
> > -
> > -     if (clazz == ELFCLASS32)
> > -             ret = elf32_scan_dynamic(map, dyn_offset, dyn_size,
> load_vaddr - load_offset);
> > -     else if (clazz == ELFCLASS64)
> > -             ret = elf64_scan_dynamic(map, dyn_offset, dyn_size,
> load_vaddr - load_offset);
> > -
> > -err_out:
> > -     if (map)
> > -             munmap(map, s.st_size);
> > -     close(fd);
> > -
> > -     return ret;
> > -}
> > -
> > -void load_ldso_conf(const char *conf)
> > -{
> > -     FILE* fp = fopen(conf, "r");
> > -     char line[256];
> > -
> > -     if (!fp) {
> > -             DEBUG("failed to open %s\n", conf);
> > -             return;
> > -     }
> > -
> > -     while (!feof(fp)) {
> > -             int len;
> > -
> > -             if (!fgets(line, 256, fp))
> > -                     break;
> > -             len = strlen(line);
> > -             if (len < 2)
> > -                     continue;
> > -             if (*line == '#')
> > -                     continue;
> > -             if (line[len - 1] == '\n')
> > -                     line[len - 1] = '\0';
> > -             if (!strncmp(line, "include ", 8)) {
> > -                     char *sep = strstr(line, " ");
> > -                     glob_t gl;
> > -                     int i;
> > -
> > -                     if (!sep)
> > -                             continue;;
> > -                     while (*sep == ' ')
> > -                             sep++;
> > -                     if (glob(sep, GLOB_NOESCAPE | GLOB_MARK, NULL,
> &gl)) {
> > -                             ERROR("glob failed on %s\n", sep);
> > -                             continue;
> > -                     }
> > -                     for (i = 0; i < gl.gl_pathc; i++)
> > -                             load_ldso_conf(gl.gl_pathv[i]);
> > -                     globfree(&gl);
> > -             } else {
> > -                     struct stat s;
> > -
> > -                     if (stat(line, &s))
> > -                             continue;
> > -                     alloc_library_path(line);
> > -             }
> > -     }
> > -
> > -     fclose(fp);
> > -}
> > diff --git a/jail/elf.h b/jail/elf.h
> > deleted file mode 100644
> > index 3ae311e..0000000
> > --- a/jail/elf.h
> > +++ /dev/null
> > @@ -1,38 +0,0 @@
> > -/*
> > - * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> > - *
> > - * This program is free software; you can redistribute it and/or modify
> > - * it under the terms of the GNU Lesser General Public License version
> 2.1
> > - * as published by the Free Software Foundation
> > - *
> > - * This program is distributed in the hope that it will be useful,
> > - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> > - * GNU General Public License for more details.
> > - */
> > -
> > -#ifndef _ELF_H__
> > -#include <libubox/avl.h>
> > -#include <libubox/avl-cmp.h>
> > -
> > -#include "log.h"
> > -
> > -struct library {
> > -     struct avl_node avl;
> > -     char *name;
> > -     char *path;
> > -};
> > -
> > -struct library_path {
> > -     struct list_head list;
> > -     char *path;
> > -};
> > -
> > -extern struct avl_tree libraries;
> > -
> > -extern void alloc_library_path(const char *path);
> > -extern char* find_lib(char *file);
> > -extern int elf_load_deps(char *library);
> > -extern void load_ldso_conf(const char *conf);
> > -
> > -#endif
> > diff --git a/jail/jail.c b/jail/jail.c
> > index 08babde..391c196 100644
> > --- a/jail/jail.c
> > +++ b/jail/jail.c
> > @@ -12,27 +12,28 @@
> >   */
> >
> >  #define _GNU_SOURCE
> > -#include <sys/mount.h>
> > -#include <sys/prctl.h>
> > -#include <sys/wait.h>
> >
> > -#include <stdlib.h>
> > -#include <unistd.h>
> > -#include <values.h>
> >  #include <errno.h>
> > -#include <stdio.h>
> > -#include <string.h>
> > -#include <sys/stat.h>
> >  #include <fcntl.h>
> >  #include <libgen.h>
> > +#include <linux/limits.h>
> >  #include <sched.h>
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <sys/mount.h>
> > +#include <sys/prctl.h>
> > +#include <sys/stat.h>
> > +#include <sys/wait.h>
> > +#include <unistd.h>
> >
> > -#include "elf.h"
> > -#include "capabilities.h"
> > -
> > -#include <libubox/list.h>
> >  #include <libubox/uloop.h>
> >
> > +#include "capabilities.h"
> > +#include "deps.h"
> > +#include "jail.h"
> > +#include "log.h"
> > +
> >  #define STACK_SIZE   (1024 * 1024)
> >  #define OPT_ARGS     "P:S:C:n:r:w:d:psulo"
> >
> > @@ -48,16 +49,6 @@ static struct {
> >       int sysfs;
> >  } opts;
> >
> > -struct extra {
> > -     struct list_head list;
> > -
> > -     const char *path;
> > -     const char *name;
> > -     int readonly;
> > -};
> > -
> > -static LIST_HEAD(extras);
> > -
> >  extern int pivot_root(const char *new_root, const char *put_old);
> >
> >  int debug = 0;
> > @@ -89,42 +80,34 @@ static int mkdir_p(char *dir, mode_t mask)
> >       return ret;
> >  }
> >
> > -static int mount_bind(const char *root, const char *path, const char
> *name, int readonly, int error)
> > +int mount_bind(const char *root, const char *path, int readonly, int
> error)
> >  {
> > -     const char *p = path;
> >       struct stat s;
> > -     char old[256];
> > -     char new[256];
> > +     char new[PATH_MAX];
> >       int fd;
> >
> > -     if (strstr(p, "local"))
> > -             p = "/lib";
> > -
> > -     snprintf(old, sizeof(old), "%s/%s", path, name);
> > -     snprintf(new, sizeof(new), "%s%s", root, p);
> > -
> > -     mkdir_p(new, 0755);
> > -
> > -     snprintf(new, sizeof(new), "%s%s/%s", root, p, name);
> > -
> > -     if (stat(old, &s)) {
> > -             ERROR("%s does not exist\n", old);
> > +     if (stat(path, &s)) {
> > +             ERROR("stat(%s) failed: %s\n", path, strerror(errno));
> >               return error;
> >       }
> >
> > +     snprintf(new, sizeof(new), "%s%s", root, path);
> >       if (S_ISDIR(s.st_mode)) {
> >               mkdir_p(new, 0755);
> >       } else {
> > +             mkdir_p(dirname(new), 0755);
> > +
> > +             snprintf(new, sizeof(new), "%s%s", root, path);
> >               fd = creat(new, 0644);
> >               if (fd == -1) {
> > -                     ERROR("failed to create %s: %s\n", new,
> strerror(errno));
> > +                     ERROR("creat(%s) failed: %s\n", new,
> strerror(errno));
> >                       return -1;
> >               }
> >               close(fd);
> >       }
> >
> > -     if (mount(old, new, NULL, MS_BIND, NULL)) {
> > -             ERROR("failed to mount -B %s %s: %s\n", old, new,
> strerror(errno));
> > +     if (mount(path, new, NULL, MS_BIND, NULL)) {
> > +             ERROR("failed to mount -B %s %s: %s\n", path, new,
> strerror(errno));
> >               return -1;
> >       }
> >
> > @@ -133,16 +116,14 @@ static int mount_bind(const char *root, const char
> *path, const char *name, int
> >               return -1;
> >       }
> >
> > -     DEBUG("mount -B %s %s\n", old, new);
> > +     DEBUG("mount -B %s %s\n", path, new);
> >
> >       return 0;
> >  }
> >
> > +#define PRELOAD_SECCOMP "/lib/libpreload-seccomp.so"
> >  static int build_jail_fs()
> >  {
> > -     struct library *l;
> > -     struct extra *m;
> > -
> >       if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) {
> >               ERROR("tmpfs mount failed %s\n", strerror(errno));
> >               return -1;
> > @@ -153,29 +134,20 @@ static int build_jail_fs()
> >               return -1;
> >       }
> >
> > -     avl_init(&libraries, avl_strcmp, false, NULL);
> > -     alloc_library_path("/lib64");
> > -     alloc_library_path("/lib");
> > -     alloc_library_path("/usr/lib");
> > -     load_ldso_conf("/etc/ld.so.conf");
> > +     add_mount_if_exists("/etc/ld.so.conf", 1, -1);
> >
> > -     if (elf_load_deps(*opts.jail_argv)) {
> > +     if (add_path_and_deps(*opts.jail_argv, 1, -1)) {
> >               ERROR("failed to load dependencies\n");
> >               return -1;
> >       }
> >
> > -     if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {
> > +     if (opts.seccomp && add_path_and_deps(PRELOAD_SECCOMP, 1, -1) ==
> -1) {
> >               ERROR("failed to load libpreload-seccomp.so\n");
> >               return -1;
> >       }
> >
> > -     avl_for_each_element(&libraries, l, avl)
> > -             if (mount_bind(opts.path, l->path, l->name, 1, -1))
> > -                     return -1;
> > -
> > -     list_for_each_entry(m, &extras, list)
> > -             if (mount_bind(opts.path, m->path, m->name, m->readonly,
> 0))
> > -                     return -1;
> > +     if (mount_all(opts.path))
> > +             return -1;
> >
> >       char *mpoint;
> >       if (asprintf(&mpoint, "%s/old", opts.path) < 0) {
> > @@ -205,24 +177,19 @@ static int build_jail_fs()
> >       return 0;
> >  }
> >
> > -#define MAX_ENVP     8
> > +#define MAX_ENVP     4
> > +#define LD_PRELOAD_SECCOMP "LD_PRELOAD=" PRELOAD_SECCOMP
> >  static char** build_envp(const char *seccomp)
> >  {
> >       static char *envp[MAX_ENVP];
> > -     static char preload_var[64];
> > -     static char seccomp_var[64];
> > +     static char seccomp_var[PATH_MAX];
> > +     static char preload_var[] = LD_PRELOAD_SECCOMP;
> >       static char debug_var[] = "LD_DEBUG=all";
> > -     char *preload_lib = find_lib("libpreload-seccomp.so");
> >       int count = 0;
> >
> > -     if (seccomp && !preload_lib) {
> > -             ERROR("failed to add preload-lib to env\n");
> > -             return NULL;
> > -     }
> >       if (seccomp) {
> >               snprintf(seccomp_var, sizeof(seccomp_var),
> "SECCOMP_FILE=%s", seccomp);
> >               envp[count++] = seccomp_var;
> > -             snprintf(preload_var, sizeof(preload_var),
> "LD_PRELOAD=%s", preload_lib);
> >               envp[count++] = preload_var;
> >       }
> >       if (debug > 1)
> > @@ -279,7 +246,7 @@ static int spawn_jail()
> >       }
> >
> >       if (build_jail_fs()) {
> > -             ERROR("failed to build jail fs");
> > +             ERROR("failed to build jail fs\n");
> >               exit(EXIT_FAILURE);
> >       }
> >
> > @@ -306,24 +273,6 @@ static struct uloop_process jail_process = {
> >       .cb = jail_process_handler,
> >  };
> >
> > -static void add_extra(char *name, int readonly)
> > -{
> > -     struct extra *f;
> > -
> > -     if (*name != '/') {
> > -             ERROR("%s is not an absolute path\n", name);
> > -             return;
> > -     }
> > -
> > -     f = calloc(1, sizeof(struct extra));
> > -
> > -     f->name = basename(name);
> > -     f->path = dirname(strdup(name));
> > -     f->readonly = readonly;
> > -
> > -     list_add_tail(&f->list, &extras);
> > -}
> > -
> >  int main(int argc, char **argv)
> >  {
> >       uid_t uid = getuid();
> > @@ -338,6 +287,7 @@ int main(int argc, char **argv)
> >       }
> >
> >       umask(022);
> > +     mount_list_init();
> >
> >       while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
> >               switch (ch) {
> > @@ -358,11 +308,11 @@ int main(int argc, char **argv)
> >                       break;
> >               case 'S':
> >                       opts.seccomp = optarg;
> > -                     add_extra(optarg, 1);
> > +                     add_path_and_deps(optarg, 1, -1);
> >                       break;
> >               case 'C':
> >                       opts.capabilities = optarg;
> > -                     add_extra(optarg, 1);
> > +                     add_path_and_deps(optarg, 1, -1);
> >                       break;
> >               case 'P':
> >                       opts.namespace = 1;
> > @@ -373,19 +323,19 @@ int main(int argc, char **argv)
> >                       break;
> >               case 'r':
> >                       opts.namespace = 1;
> > -                     add_extra(optarg, 1);
> > +                     add_path_and_deps(optarg, 1, 0);
> >                       break;
> >               case 'w':
> >                       opts.namespace = 1;
> > -                     add_extra(optarg, 0);
> > +                     add_path_and_deps(optarg, 0, 0);
> >                       break;
> >               case 'u':
> >                       opts.namespace = 1;
> > -                     add_extra(ubus, 0);
> > +                     add_path_and_deps(ubus, 0, -1);
> >                       break;
> >               case 'l':
> >                       opts.namespace = 1;
> > -                     add_extra(log, 0);
> > +                     add_path_and_deps(log, 0, -1);
> >                       break;
> >               }
> >       }
> > diff --git a/jail/jail.h b/jail/jail.h
> > new file mode 100644
> > index 0000000..fc69ef6
> > --- /dev/null
> > +++ b/jail/jail.h
> > @@ -0,0 +1,18 @@
> > +/*
> > + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU Lesser General Public License version
> 2.1
> > + * as published by the Free Software Foundation
> > + *
> > + * This program is distributed in the hope that it will be useful,
> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> > + * GNU General Public License for more details.
> > + */
> > +
> > +#ifndef _JAIL_H__
> > +
> > +int mount_bind(const char *root, const char *path, int readonly, int
> error);
> > +
> > +#endif
> >
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel@lists.openwrt.org
> https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
>

On 21/11/2015 12:06, Etienne Champetier wrote:
> Hi,
> 
> first sorry, i've forgot to add the ticket reference
> https://dev.openwrt.org/ticket/20785
> 
> also full disclore, I'm only writing C for OpenWrt
> so is there a compilation flag to disable C++,
> or can you be more specific on what C++ ism i'm using ?

// is c++

/* this is the c version */

void foo() should be replaced with static void foo(void)

i am a bit suprised that procd compiled without warning for you. i'll
verify the compiler flags later today

	John

> 
> 2015-11-21 9:08 GMT+01:00 John Crispin <john@phrozen.org
> <mailto:john@phrozen.org>>:
> 
> 
> 
>     On 21/11/2015 00:05, Etienne CHAMPETIER wrote:
>     > Using ldd (via popen()) is a hack, but it's simpler (and working)
> 
>     indeed
> 
>     > we have 3 libc and many archs, too many ways to resolve .so
>     where does it break ?
> 
> 
>     > Current code:
>     > -do not parse the intepreter (PT_INTERP) part of the elf
>     why should it ?
> 
> 
> 
> here is the output of "objdump -x -s" on /bin/cat (subtarget x86_64 / DD)
> 
>     Dynamic Section:
>       NEEDED               libgcc_s.so.1
>       NEEDED               libc.so
>     Contents of section .interp:
>      /lib/ld-musl-x86_64.so.1
> 
> and the output of ldd /bin/cat
> 
>     root@OpenWrt:/# ldd /bin/cat
>         /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)
>         libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7fbe78371000)
>         libc.so => /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)
> 
> 
> if you run "ujail -d1 -p -- /bin/cat /proc/self/mounts"
> the execve() call fail with "ENOENT (No such file or directory)"
> 
> now if you add "/lib/ld-musl-x86_64.so.1" to the jail (-r), and you
> remove symlink
> from /lib64 to /lib, it works
> 
> the good question is why does it fails with musl/DD and work with
> uclibc/CC and glibc?
> 
> 
>     > -do not get the library path priority right (/lib64 is before /lib,
>     > musl take the libs in /lib even on 64bits images)
> 
>     libc dependent and not procd depended
> 
> 
> ujail has to resolve the same libs as the libc does,
> so it depends on the libc, but it's still a ujail problem
> that was my main motivation to use ldd
> 
> 
>     > -do not handle RPATH
>     >
>     > This patch:
>     > -use ldd to detect ELF dependencies
>     > -add support for shell script
> 
>     elaborate that please
> 
> 
> if the file start with #!, add the exec and it dependencies to the jail
>  
> 
> 
> 
>     > uClibc ldd doesn't work with shared lib, thus this patch break
>     > seccomp with uClibc
> 
>     so after you patch we can never again update procd in CC ?
> 
> 
> yes
> 
> i will try to improve the current elf parsing code,
> but i'm afraid that it will break depending on the arch and ...
>  
> 
> 
>             John
> 
>     >
>     > Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com
>     <mailto:champetier.etienne@gmail.com>>
>     > ---
>     >  CMakeLists.txt |   2 +-
>     >  jail/deps.c    | 198 ++++++++++++++++++++++++++++++++
>     >  jail/deps.h    |  23 ++++
>     >  jail/elf.c     | 355
>     ---------------------------------------------------------
>     >  jail/elf.h     |  38 ------
>     >  jail/jail.c    | 138 +++++++---------------
>     >  jail/jail.h    |  18 +++
>     >  7 files changed, 284 insertions(+), 488 deletions(-)
>     >  create mode 100644 jail/deps.c
>     >  create mode 100644 jail/deps.h
>     >  delete mode 100644 jail/elf.c
>     >  delete mode 100644 jail/elf.h
>     >  create mode 100644 jail/jail.h
>     >
>     > diff --git a/CMakeLists.txt b/CMakeLists.txt
>     > index d749c25..8e3f7ea 100644
>     > --- a/CMakeLists.txt
>     > +++ b/CMakeLists.txt
>     > @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)
>     >  endif()
>     >
>     >  IF(JAIL_SUPPORT)
>     > -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)
>     > +ADD_EXECUTABLE(ujail jail/jail.c jail/deps.c jail/capabilities.c)
>     >  TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)
>     >  INSTALL(TARGETS ujail
>     >       RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
>     > diff --git a/jail/deps.c b/jail/deps.c
>     > new file mode 100644
>     > index 0000000..0141cef
>     > --- /dev/null
>     > +++ b/jail/deps.c
>     > @@ -0,0 +1,198 @@
>     > +/*
>     > + * Copyright (C) 2015 John Crispin <blogic@openwrt.org
>     <mailto:blogic@openwrt.org>>
>     > + * Copyright (C) 2015 Etienne Champetier
>     <champetier.etienne@gmail.com <mailto:champetier.etienne@gmail.com>>
>     > + *
>     > + * This program is free software; you can redistribute it and/or
>     modify
>     > + * it under the terms of the GNU Lesser General Public License
>     version 2.1
>     > + * as published by the Free Software Foundation
>     > + *
>     > + * This program is distributed in the hope that it will be useful,
>     > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>     > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>     > + * GNU General Public License for more details.
>     > + */
>     > +
>     > +#define _GNU_SOURCE
>     > +
>     > +#include <assert.h>
>     > +#include <elf.h>
>     > +#include <errno.h>
>     > +#include <fcntl.h>
>     > +#include <libgen.h>
>     > +#include <linux/limits.h>
>     > +#include <stdio.h>
>     > +#include <stdlib.h>
>     > +#include <string.h>
>     > +#include <sys/mount.h>
>     > +#include <sys/stat.h>
>     > +#include <sys/types.h>
>     > +#include <unistd.h>
>     > +
>     > +#include <libubox/avl.h>
>     > +#include <libubox/avl-cmp.h>
>     > +
>     > +#include "deps.h"
>     > +#include "log.h"
>     > +#include "jail.h"
>     > +
>     > +struct mount {
>     > +        struct avl_node avl;
>     > +        const char *path;
>     > +        int readonly;
>     > +        int error;
>     > +};
>     > +
>     > +struct avl_tree mounts;
>     > +
>     > +static int add_mount(const char *path, int readonly, int error)
>     > +{
>     > +     if (avl_find(&mounts, path))
>     > +             return 1;
>     > +
>     > +     struct mount *m;
>     > +     m = calloc(1, sizeof(struct mount));
>     > +     assert(m != NULL);
>     > +     m->avl.key = m->path = strdup(path);
>     > +     m->readonly = readonly;
>     > +     m->error = error;
>     > +
>     > +     avl_insert(&mounts, &m->avl);
>     > +     DEBUG("adding mount %s ro(%d) err(%d)\n", m->path,
>     m->readonly, m->error != 0);
>     > +     return 0;
>     > +}
>     > +
>     > +int add_mount_if_exists(const char *path, int readonly, int error) {
>     > +     struct stat s;
>     > +     if (stat(path, &s) == -1) {
>     > +             DEBUG("%s doesn't exist\n", path);
>     > +             return -1;
>     > +     }
>     > +     return add_mount(path, readonly, error);
>     > +}
>     > +
>     > +int mount_all(const char *jailroot) {
>     > +     struct mount *m;
>     > +     avl_for_each_element(&mounts, m, avl)
>     > +             if (mount_bind(jailroot, m->path, m->readonly,
>     m->error))
>     > +                     return -1;
>     > +
>     > +     return 0;
>     > +}
>     > +
>     > +void mount_list_init() {
>     > +     avl_init(&mounts, avl_strcmp, false, NULL);
>     > +}
>     > +
>     > +//we already read 2 char from f (#!)
>     > +static int add_script_deps(FILE *f, const char *path, int
>     readonly, int error)
>     > +{
>     > +     char buf[PATH_MAX];
>     > +     int i = 0;
>     > +     int c;
>     > +     while ((c = fgetc(f)) != EOF) {
>     > +             if (i == 0 && c != '/')
>     > +                     continue;
>     > +             if (c <= 0x20 || c > 0x7e)
>     > +                     break;
>     > +             buf[i] = c;
>     > +             i++;
>     > +             if (i >= sizeof(buf)) {
>     > +                     ERROR("script interpretor too long (%s)\n",
>     path);
>     > +                     return -1;
>     > +             }
>     > +     }
>     > +     buf[i] = '\0';
>     > +     return add_path_and_deps(buf, readonly, error);
>     > +}
>     > +
>     > +static int add_elf_deps(const char *path, int readonly, int error)
>     > +{
>     > +     char buf[PATH_MAX];
>     > +     int nb = snprintf(buf, sizeof(buf), "ldd %s", path);
>     > +     assert(nb >= 0);
>     > +
>     > +     FILE *f = popen(buf, "r");
>     > +     char c;
>     > +     int i = 0;
>     > +     while (((c = fgetc(f)) != EOF)) {
>     > +             if (i == 0 && c != '/') {
>     > +                     continue;
>     > +             } else if (i > 0 && (c <= ' ' || c > '~')) {
>     > +                     buf[i] = '\0';
>     > +                     add_mount(buf, readonly, error);
>     > +                     i = 0;
>     > +             } else if (i > 0 || c == '/') {
>     > +                     buf[i] = c;
>     > +                     i++;
>     > +             }
>     > +
>     > +             if (i >= sizeof(buf)) {
>     > +                     ERROR("shared lib too long (%s)\n", path);
>     > +                     return -1;
>     > +             }
>     > +     }
>     > +     pclose(f);
>     > +     return 0;
>     > +}
>     > +
>     > +int add_path_and_deps(const char *path, int readonly, int error)
>     > +{
>     > +     assert(path != NULL);
>     > +
>     > +     if (path[0] != '/') {
>     > +             ERROR("only absolute path are supported (%s)\n", path);
>     > +             return error;
>     > +     }
>     > +
>     > +     struct stat s;
>     > +     if (stat(path, &s) == -1) {
>     > +             ERROR("stat(%s) failed: %s\n", path, strerror(errno));
>     > +             return error;
>     > +     }
>     > +
>     > +     //path already in list
>     > +     if (add_mount(path, readonly, error) == 1)
>     > +             return 0;
>     > +
>     > +     if (!S_ISREG(s.st_mode))
>     > +             return 0;
>     > +
>     > +     //too small to be an ELF or a script
>     > +     if (s.st_size < 4)
>     > +             return 0;
>     > +
>     > +     FILE *f;
>     > +     if ((f = fopen(path, "r")) == NULL) {
>     > +             ERROR("fopen(%s) failed: %s\n", path, strerror(errno));
>     > +             return error;
>     > +     }
>     > +
>     > +     int ret = 0;
>     > +     int c = fgetc(f);
>     > +     switch(c) {
>     > +     //script ?
>     > +     case '#':
>     > +             c = fgetc(f);
>     > +             if (c != '!') {
>     > +                     goto out;
>     > +             }
>     > +             //this is a script
>     > +             ret = add_script_deps(f, path, readonly, error);
>     > +             goto out;
>     > +     //elf ?
>     > +     case ELFMAG0:
>     > +             if ((c = fgetc(f)) != ELFMAG1
>     > +                     || (c = fgetc(f)) != ELFMAG2
>     > +                     || (c = fgetc(f)) != ELFMAG3) {
>     > +                     goto out;
>     > +             }
>     > +             ret = add_elf_deps(path, readonly, error);
>     > +             goto out;
>     > +     }
>     > +out:
>     > +     if (f != NULL)
>     > +             fclose(f);
>     > +
>     > +     return ret;
>     > +}
>     > +
>     > diff --git a/jail/deps.h b/jail/deps.h
>     > new file mode 100644
>     > index 0000000..da2a914
>     > --- /dev/null
>     > +++ b/jail/deps.h
>     > @@ -0,0 +1,23 @@
>     > +/*
>     > + * Copyright (C) 2015 Etienne Champetier
>     <champetier.etienne@gmail.com <mailto:champetier.etienne@gmail.com>>
>     > + *
>     > + * This program is free software; you can redistribute it and/or
>     modify
>     > + * it under the terms of the GNU Lesser General Public License
>     version 2.1
>     > + * as published by the Free Software Foundation
>     > + *
>     > + * This program is distributed in the hope that it will be useful,
>     > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>     > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>     > + * GNU General Public License for more details.
>     > + */
>     > +
>     > +#ifndef _DEPS_H__
>     > +
>     > +#include "log.h"
>     > +
>     > +int add_mount_if_exists(const char *path, int readonly, int error);
>     > +int add_path_and_deps(const char *path, int readonly, int error);
>     > +int mount_all(const char *jailroot);
>     > +void mount_list_init();
>     > +
>     > +#endif
>     > diff --git a/jail/elf.c b/jail/elf.c
>     > deleted file mode 100644
>     > index cbb3051..0000000
>     > --- a/jail/elf.c
>     > +++ /dev/null
>     > @@ -1,355 +0,0 @@
>     > -/*
>     > - * Copyright (C) 2015 John Crispin <blogic@openwrt.org
>     <mailto:blogic@openwrt.org>>
>     > - *
>     > - * This program is free software; you can redistribute it and/or
>     modify
>     > - * it under the terms of the GNU Lesser General Public License
>     version 2.1
>     > - * as published by the Free Software Foundation
>     > - *
>     > - * This program is distributed in the hope that it will be useful,
>     > - * but WITHOUT ANY WARRANTY; without even the implied warranty of
>     > - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>     > - * GNU General Public License for more details.
>     > - */
>     > -
>     > -#define _GNU_SOURCE
>     > -#include <sys/mman.h>
>     > -
>     > -#include <stdlib.h>
>     > -#include <unistd.h>
>     > -#include <stdio.h>
>     > -#include <string.h>
>     > -#include <sys/stat.h>
>     > -#include <fcntl.h>
>     > -#include <libgen.h>
>     > -#include <glob.h>
>     > -#include <elf.h>
>     > -
>     > -#include <libubox/utils.h>
>     > -
>     > -#include "elf.h"
>     > -
>     > -struct avl_tree libraries;
>     > -static LIST_HEAD(library_paths);
>     > -
>     > -void alloc_library_path(const char *path)
>     > -{
>     > -     struct library_path *p;
>     > -     char *_path;
>     > -
>     > -     p = calloc_a(sizeof(*p),
>     > -             &_path, strlen(path) + 1);
>     > -     if (!p)
>     > -             return;
>     > -
>     > -     p->path = strcpy(_path, path);
>     > -
>     > -     list_add_tail(&p->list, &library_paths);
>     > -     DEBUG("adding ld.so path %s\n", path);
>     > -}
>     > -
>     > -static void alloc_library(const char *path, const char *name)
>     > -{
>     > -     struct library *l;
>     > -     char *_name, *_path;
>     > -
>     > -     l = calloc_a(sizeof(*l),
>     > -             &_path, strlen(path) + 1,
>     > -             &_name, strlen(name) + 1);
>     > -     if (!l)
>     > -             return;
>     > -
>     > -     l->avl.key = l->name = strcpy(_name, name);
>     > -     l->path = strcpy(_path, path);
>     > -
>     > -     avl_insert(&libraries, &l->avl);
>     > -     DEBUG("adding library %s/%s\n", path, name);
>     > -}
>     > -
>     > -static int elf_open(char **dir, char *file)
>     > -{
>     > -     struct library_path *p;
>     > -     char path[256];
>     > -     int fd = -1;
>     > -
>     > -     *dir = NULL;
>     > -
>     > -     list_for_each_entry(p, &library_paths, list) {
>     > -             if (strlen(p->path))
>     > -                     snprintf(path, sizeof(path), "%s/%s",
>     p->path, file);
>     > -             else
>     > -                     strncpy(path, file, sizeof(path));
>     > -             fd = open(path, O_RDONLY);
>     > -             if (fd >= 0) {
>     > -                     *dir = p->path;
>     > -                     break;
>     > -             }
>     > -     }
>     > -
>     > -     if (fd == -1)
>     > -             fd = open(file, O_RDONLY);
>     > -
>     > -     return fd;
>     > -}
>     > -
>     > -char* find_lib(char *file)
>     > -{
>     > -     struct library *l;
>     > -     static char path[256];
>     > -     const char *p;
>     > -
>     > -     l = avl_find_element(&libraries, file, l, avl);
>     > -     if (!l)
>     > -             return NULL;
>     > -
>     > -     p = l->path;
>     > -     if (strstr(p, "local"))
>     > -             p = "/lib";
>     > -
>     > -     snprintf(path, sizeof(path), "%s/%s", p, file);
>     > -
>     > -     return path;
>     > -}
>     > -
>     > -static int elf64_find_section(char *map, unsigned int type,
>     unsigned int *offset, unsigned int *size, unsigned int *vaddr)
>     > -{
>     > -     Elf64_Ehdr *e;
>     > -     Elf64_Phdr *ph;
>     > -     int i;
>     > -
>     > -     e = (Elf64_Ehdr *) map;
>     > -     ph = (Elf64_Phdr *) (map + e->e_phoff);
>     > -
>     > -     for (i = 0; i < e->e_phnum; i++) {
>     > -             if (ph[i].p_type == type) {
>     > -                     *offset = ph[i].p_offset;
>     > -                     if (size)
>     > -                             *size = ph[i].p_filesz;
>     > -                     if (vaddr)
>     > -                             *vaddr = ph[i].p_vaddr;
>     > -                     return 0;
>     > -             }
>     > -     }
>     > -
>     > -     return -1;
>     > -}
>     > -
>     > -static int elf32_find_section(char *map, unsigned int type,
>     unsigned int *offset, unsigned int *size, unsigned int *vaddr)
>     > -{
>     > -     Elf32_Ehdr *e;
>     > -     Elf32_Phdr *ph;
>     > -     int i;
>     > -
>     > -     e = (Elf32_Ehdr *) map;
>     > -     ph = (Elf32_Phdr *) (map + e->e_phoff);
>     > -
>     > -     for (i = 0; i < e->e_phnum; i++) {
>     > -             if (ph[i].p_type == type) {
>     > -                     *offset = ph[i].p_offset;
>     > -                     if (size)
>     > -                             *size = ph[i].p_filesz;
>     > -                     if (vaddr)
>     > -                             *vaddr = ph[i].p_vaddr;
>     > -                     return 0;
>     > -             }
>     > -     }
>     > -
>     > -     return -1;
>     > -}
>     > -
>     > -static int elf_find_section(char *map, unsigned int type,
>     unsigned int *offset, unsigned int *size, unsigned int *vaddr)
>     > -{
>     > -     int clazz = map[EI_CLASS];
>     > -
>     > -     if (clazz == ELFCLASS32)
>     > -             return elf32_find_section(map, type, offset, size,
>     vaddr);
>     > -     else if (clazz == ELFCLASS64)
>     > -             return elf64_find_section(map, type, offset, size,
>     vaddr);
>     > -
>     > -     ERROR("unknown elf format %d\n", clazz);
>     > -
>     > -     return -1;
>     > -}
>     > -
>     > -static int elf32_scan_dynamic(char *map, int dyn_offset, int
>     dyn_size, int load_offset)
>     > -{
>     > -     Elf32_Dyn *dynamic = (Elf32_Dyn *) (map + dyn_offset);
>     > -     char *strtab = NULL;
>     > -
>     > -     while ((void *) dynamic < (void *) (map + dyn_offset +
>     dyn_size)) {
>     > -             Elf32_Dyn *curr = dynamic;
>     > -
>     > -             dynamic++;
>     > -             if (curr->d_tag != DT_STRTAB)
>     > -                     continue;
>     > -
>     > -             strtab = map + (curr->d_un.d_val - load_offset);
>     > -             break;
>     > -     }
>     > -
>     > -     if (!strtab)
>     > -             return -1;
>     > -
>     > -     dynamic = (Elf32_Dyn *) (map + dyn_offset);
>     > -     while ((void *) dynamic < (void *) (map + dyn_offset +
>     dyn_size)) {
>     > -             Elf32_Dyn *curr = dynamic;
>     > -
>     > -             dynamic++;
>     > -             if (curr->d_tag != DT_NEEDED)
>     > -                     continue;
>     > -
>     > -             if (elf_load_deps(&strtab[curr->d_un.d_val]))
>     > -                     return -1;
>     > -     }
>     > -
>     > -     return 0;
>     > -}
>     > -
>     > -static int elf64_scan_dynamic(char *map, int dyn_offset, int
>     dyn_size, int load_offset)
>     > -{
>     > -     Elf64_Dyn *dynamic = (Elf64_Dyn *) (map + dyn_offset);
>     > -     char *strtab = NULL;
>     > -
>     > -     while ((void *) dynamic < (void *) (map + dyn_offset +
>     dyn_size)) {
>     > -             Elf64_Dyn *curr = dynamic;
>     > -
>     > -             dynamic++;
>     > -             if (curr->d_tag != DT_STRTAB)
>     > -                     continue;
>     > -
>     > -             strtab = map + (curr->d_un.d_val - load_offset);
>     > -             break;
>     > -     }
>     > -
>     > -     if (!strtab)
>     > -             return -1;
>     > -
>     > -     dynamic = (Elf64_Dyn *) (map + dyn_offset);
>     > -     while ((void *) dynamic < (void *) (map + dyn_offset +
>     dyn_size)) {
>     > -             Elf64_Dyn *curr = dynamic;
>     > -
>     > -             dynamic++;
>     > -             if (curr->d_tag != DT_NEEDED)
>     > -                     continue;
>     > -
>     > -             if (elf_load_deps(&strtab[curr->d_un.d_val]))
>     > -                     return -1;
>     > -     }
>     > -
>     > -     return 0;
>     > -}
>     > -
>     > -int elf_load_deps(char *library)
>     > -{
>     > -     unsigned int dyn_offset, dyn_size;
>     > -     unsigned int load_offset, load_vaddr;
>     > -     struct stat s;
>     > -     char *map = NULL, *dir = NULL;
>     > -     int clazz, fd, ret = -1;
>     > -
>     > -     if (avl_find(&libraries, library))
>     > -             return 0;
>     > -
>     > -     fd = elf_open(&dir, library);
>     > -
>     > -     if (fd < 0) {
>     > -             ERROR("failed to open %s\n", library);
>     > -             return -1;
>     > -     }
>     > -
>     > -     if (fstat(fd, &s) == -1) {
>     > -             ERROR("failed to stat %s\n", library);
>     > -             ret = -1;
>     > -             goto err_out;
>     > -     }
>     > -
>     > -     map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
>     > -     if (map == MAP_FAILED) {
>     > -             ERROR("failed to mmap %s\n", library);
>     > -             ret = -1;
>     > -             goto err_out;
>     > -     }
>     > -
>     > -     if (elf_find_section(map, PT_LOAD, &load_offset, NULL,
>     &load_vaddr)) {
>     > -             ERROR("failed to load the .load section from %s\n",
>     library);
>     > -             ret = -1;
>     > -             goto err_out;
>     > -     }
>     > -
>     > -     if (elf_find_section(map, PT_DYNAMIC, &dyn_offset,
>     &dyn_size, NULL)) {
>     > -             ERROR("failed to load the .dynamic section from
>     %s\n", library);
>     > -             ret = -1;
>     > -             goto err_out;
>     > -     }
>     > -
>     > -     if (dir) {
>     > -             alloc_library(dir, library);
>     > -     } else {
>     > -             char *elf = strdup(library);
>     > -
>     > -             alloc_library(dirname(elf), basename(library));
>     > -             free(elf);
>     > -     }
>     > -     clazz = map[EI_CLASS];
>     > -
>     > -     if (clazz == ELFCLASS32)
>     > -             ret = elf32_scan_dynamic(map, dyn_offset, dyn_size,
>     load_vaddr - load_offset);
>     > -     else if (clazz == ELFCLASS64)
>     > -             ret = elf64_scan_dynamic(map, dyn_offset, dyn_size,
>     load_vaddr - load_offset);
>     > -
>     > -err_out:
>     > -     if (map)
>     > -             munmap(map, s.st_size);
>     > -     close(fd);
>     > -
>     > -     return ret;
>     > -}
>     > -
>     > -void load_ldso_conf(const char *conf)
>     > -{
>     > -     FILE* fp = fopen(conf, "r");
>     > -     char line[256];
>     > -
>     > -     if (!fp) {
>     > -             DEBUG("failed to open %s\n", conf);
>     > -             return;
>     > -     }
>     > -
>     > -     while (!feof(fp)) {
>     > -             int len;
>     > -
>     > -             if (!fgets(line, 256, fp))
>     > -                     break;
>     > -             len = strlen(line);
>     > -             if (len < 2)
>     > -                     continue;
>     > -             if (*line == '#')
>     > -                     continue;
>     > -             if (line[len - 1] == '\n')
>     > -                     line[len - 1] = '\0';
>     > -             if (!strncmp(line, "include ", 8)) {
>     > -                     char *sep = strstr(line, " ");
>     > -                     glob_t gl;
>     > -                     int i;
>     > -
>     > -                     if (!sep)
>     > -                             continue;;
>     > -                     while (*sep == ' ')
>     > -                             sep++;
>     > -                     if (glob(sep, GLOB_NOESCAPE | GLOB_MARK,
>     NULL, &gl)) {
>     > -                             ERROR("glob failed on %s\n", sep);
>     > -                             continue;
>     > -                     }
>     > -                     for (i = 0; i < gl.gl_pathc; i++)
>     > -                             load_ldso_conf(gl.gl_pathv[i]);
>     > -                     globfree(&gl);
>     > -             } else {
>     > -                     struct stat s;
>     > -
>     > -                     if (stat(line, &s))
>     > -                             continue;
>     > -                     alloc_library_path(line);
>     > -             }
>     > -     }
>     > -
>     > -     fclose(fp);
>     > -}
>     > diff --git a/jail/elf.h b/jail/elf.h
>     > deleted file mode 100644
>     > index 3ae311e..0000000
>     > --- a/jail/elf.h
>     > +++ /dev/null
>     > @@ -1,38 +0,0 @@
>     > -/*
>     > - * Copyright (C) 2015 John Crispin <blogic@openwrt.org
>     <mailto:blogic@openwrt.org>>
>     > - *
>     > - * This program is free software; you can redistribute it and/or
>     modify
>     > - * it under the terms of the GNU Lesser General Public License
>     version 2.1
>     > - * as published by the Free Software Foundation
>     > - *
>     > - * This program is distributed in the hope that it will be useful,
>     > - * but WITHOUT ANY WARRANTY; without even the implied warranty of
>     > - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>     > - * GNU General Public License for more details.
>     > - */
>     > -
>     > -#ifndef _ELF_H__
>     > -#include <libubox/avl.h>
>     > -#include <libubox/avl-cmp.h>
>     > -
>     > -#include "log.h"
>     > -
>     > -struct library {
>     > -     struct avl_node avl;
>     > -     char *name;
>     > -     char *path;
>     > -};
>     > -
>     > -struct library_path {
>     > -     struct list_head list;
>     > -     char *path;
>     > -};
>     > -
>     > -extern struct avl_tree libraries;
>     > -
>     > -extern void alloc_library_path(const char *path);
>     > -extern char* find_lib(char *file);
>     > -extern int elf_load_deps(char *library);
>     > -extern void load_ldso_conf(const char *conf);
>     > -
>     > -#endif
>     > diff --git a/jail/jail.c b/jail/jail.c
>     > index 08babde..391c196 100644
>     > --- a/jail/jail.c
>     > +++ b/jail/jail.c
>     > @@ -12,27 +12,28 @@
>     >   */
>     >
>     >  #define _GNU_SOURCE
>     > -#include <sys/mount.h>
>     > -#include <sys/prctl.h>
>     > -#include <sys/wait.h>
>     >
>     > -#include <stdlib.h>
>     > -#include <unistd.h>
>     > -#include <values.h>
>     >  #include <errno.h>
>     > -#include <stdio.h>
>     > -#include <string.h>
>     > -#include <sys/stat.h>
>     >  #include <fcntl.h>
>     >  #include <libgen.h>
>     > +#include <linux/limits.h>
>     >  #include <sched.h>
>     > +#include <stdio.h>
>     > +#include <stdlib.h>
>     > +#include <string.h>
>     > +#include <sys/mount.h>
>     > +#include <sys/prctl.h>
>     > +#include <sys/stat.h>
>     > +#include <sys/wait.h>
>     > +#include <unistd.h>
>     >
>     > -#include "elf.h"
>     > -#include "capabilities.h"
>     > -
>     > -#include <libubox/list.h>
>     >  #include <libubox/uloop.h>
>     >
>     > +#include "capabilities.h"
>     > +#include "deps.h"
>     > +#include "jail.h"
>     > +#include "log.h"
>     > +
>     >  #define STACK_SIZE   (1024 * 1024)
>     >  #define OPT_ARGS     "P:S:C:n:r:w:d:psulo"
>     >
>     > @@ -48,16 +49,6 @@ static struct {
>     >       int sysfs;
>     >  } opts;
>     >
>     > -struct extra {
>     > -     struct list_head list;
>     > -
>     > -     const char *path;
>     > -     const char *name;
>     > -     int readonly;
>     > -};
>     > -
>     > -static LIST_HEAD(extras);
>     > -
>     >  extern int pivot_root(const char *new_root, const char *put_old);
>     >
>     >  int debug = 0;
>     > @@ -89,42 +80,34 @@ static int mkdir_p(char *dir, mode_t mask)
>     >       return ret;
>     >  }
>     >
>     > -static int mount_bind(const char *root, const char *path, const
>     char *name, int readonly, int error)
>     > +int mount_bind(const char *root, const char *path, int readonly,
>     int error)
>     >  {
>     > -     const char *p = path;
>     >       struct stat s;
>     > -     char old[256];
>     > -     char new[256];
>     > +     char new[PATH_MAX];
>     >       int fd;
>     >
>     > -     if (strstr(p, "local"))
>     > -             p = "/lib";
>     > -
>     > -     snprintf(old, sizeof(old), "%s/%s", path, name);
>     > -     snprintf(new, sizeof(new), "%s%s", root, p);
>     > -
>     > -     mkdir_p(new, 0755);
>     > -
>     > -     snprintf(new, sizeof(new), "%s%s/%s", root, p, name);
>     > -
>     > -     if (stat(old, &s)) {
>     > -             ERROR("%s does not exist\n", old);
>     > +     if (stat(path, &s)) {
>     > +             ERROR("stat(%s) failed: %s\n", path, strerror(errno));
>     >               return error;
>     >       }
>     >
>     > +     snprintf(new, sizeof(new), "%s%s", root, path);
>     >       if (S_ISDIR(s.st_mode)) {
>     >               mkdir_p(new, 0755);
>     >       } else {
>     > +             mkdir_p(dirname(new), 0755);
>     > +
>     > +             snprintf(new, sizeof(new), "%s%s", root, path);
>     >               fd = creat(new, 0644);
>     >               if (fd == -1) {
>     > -                     ERROR("failed to create %s: %s\n", new,
>     strerror(errno));
>     > +                     ERROR("creat(%s) failed: %s\n", new,
>     strerror(errno));
>     >                       return -1;
>     >               }
>     >               close(fd);
>     >       }
>     >
>     > -     if (mount(old, new, NULL, MS_BIND, NULL)) {
>     > -             ERROR("failed to mount -B %s %s: %s\n", old, new,
>     strerror(errno));
>     > +     if (mount(path, new, NULL, MS_BIND, NULL)) {
>     > +             ERROR("failed to mount -B %s %s: %s\n", path, new,
>     strerror(errno));
>     >               return -1;
>     >       }
>     >
>     > @@ -133,16 +116,14 @@ static int mount_bind(const char *root,
>     const char *path, const char *name, int
>     >               return -1;
>     >       }
>     >
>     > -     DEBUG("mount -B %s %s\n", old, new);
>     > +     DEBUG("mount -B %s %s\n", path, new);
>     >
>     >       return 0;
>     >  }
>     >
>     > +#define PRELOAD_SECCOMP "/lib/libpreload-seccomp.so"
>     >  static int build_jail_fs()
>     >  {
>     > -     struct library *l;
>     > -     struct extra *m;
>     > -
>     >       if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME,
>     "mode=0755")) {
>     >               ERROR("tmpfs mount failed %s\n", strerror(errno));
>     >               return -1;
>     > @@ -153,29 +134,20 @@ static int build_jail_fs()
>     >               return -1;
>     >       }
>     >
>     > -     avl_init(&libraries, avl_strcmp, false, NULL);
>     > -     alloc_library_path("/lib64");
>     > -     alloc_library_path("/lib");
>     > -     alloc_library_path("/usr/lib");
>     > -     load_ldso_conf("/etc/ld.so.conf");
>     > +     add_mount_if_exists("/etc/ld.so.conf", 1, -1);
>     >
>     > -     if (elf_load_deps(*opts.jail_argv)) {
>     > +     if (add_path_and_deps(*opts.jail_argv, 1, -1)) {
>     >               ERROR("failed to load dependencies\n");
>     >               return -1;
>     >       }
>     >
>     > -     if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {
>     > +     if (opts.seccomp && add_path_and_deps(PRELOAD_SECCOMP, 1,
>     -1) == -1) {
>     >               ERROR("failed to load libpreload-seccomp.so\n");
>     >               return -1;
>     >       }
>     >
>     > -     avl_for_each_element(&libraries, l, avl)
>     > -             if (mount_bind(opts.path, l->path, l->name, 1, -1))
>     > -                     return -1;
>     > -
>     > -     list_for_each_entry(m, &extras, list)
>     > -             if (mount_bind(opts.path, m->path, m->name,
>     m->readonly, 0))
>     > -                     return -1;
>     > +     if (mount_all(opts.path))
>     > +             return -1;
>     >
>     >       char *mpoint;
>     >       if (asprintf(&mpoint, "%s/old", opts.path) < 0) {
>     > @@ -205,24 +177,19 @@ static int build_jail_fs()
>     >       return 0;
>     >  }
>     >
>     > -#define MAX_ENVP     8
>     > +#define MAX_ENVP     4
>     > +#define LD_PRELOAD_SECCOMP "LD_PRELOAD=" PRELOAD_SECCOMP
>     >  static char** build_envp(const char *seccomp)
>     >  {
>     >       static char *envp[MAX_ENVP];
>     > -     static char preload_var[64];
>     > -     static char seccomp_var[64];
>     > +     static char seccomp_var[PATH_MAX];
>     > +     static char preload_var[] = LD_PRELOAD_SECCOMP;
>     >       static char debug_var[] = "LD_DEBUG=all";
>     > -     char *preload_lib = find_lib("libpreload-seccomp.so");
>     >       int count = 0;
>     >
>     > -     if (seccomp && !preload_lib) {
>     > -             ERROR("failed to add preload-lib to env\n");
>     > -             return NULL;
>     > -     }
>     >       if (seccomp) {
>     >               snprintf(seccomp_var, sizeof(seccomp_var),
>     "SECCOMP_FILE=%s", seccomp);
>     >               envp[count++] = seccomp_var;
>     > -             snprintf(preload_var, sizeof(preload_var),
>     "LD_PRELOAD=%s", preload_lib);
>     >               envp[count++] = preload_var;
>     >       }
>     >       if (debug > 1)
>     > @@ -279,7 +246,7 @@ static int spawn_jail()
>     >       }
>     >
>     >       if (build_jail_fs()) {
>     > -             ERROR("failed to build jail fs");
>     > +             ERROR("failed to build jail fs\n");
>     >               exit(EXIT_FAILURE);
>     >       }
>     >
>     > @@ -306,24 +273,6 @@ static struct uloop_process jail_process = {
>     >       .cb = jail_process_handler,
>     >  };
>     >
>     > -static void add_extra(char *name, int readonly)
>     > -{
>     > -     struct extra *f;
>     > -
>     > -     if (*name != '/') {
>     > -             ERROR("%s is not an absolute path\n", name);
>     > -             return;
>     > -     }
>     > -
>     > -     f = calloc(1, sizeof(struct extra));
>     > -
>     > -     f->name = basename(name);
>     > -     f->path = dirname(strdup(name));
>     > -     f->readonly = readonly;
>     > -
>     > -     list_add_tail(&f->list, &extras);
>     > -}
>     > -
>     >  int main(int argc, char **argv)
>     >  {
>     >       uid_t uid = getuid();
>     > @@ -338,6 +287,7 @@ int main(int argc, char **argv)
>     >       }
>     >
>     >       umask(022);
>     > +     mount_list_init();
>     >
>     >       while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
>     >               switch (ch) {
>     > @@ -358,11 +308,11 @@ int main(int argc, char **argv)
>     >                       break;
>     >               case 'S':
>     >                       opts.seccomp = optarg;
>     > -                     add_extra(optarg, 1);
>     > +                     add_path_and_deps(optarg, 1, -1);
>     >                       break;
>     >               case 'C':
>     >                       opts.capabilities = optarg;
>     > -                     add_extra(optarg, 1);
>     > +                     add_path_and_deps(optarg, 1, -1);
>     >                       break;
>     >               case 'P':
>     >                       opts.namespace = 1;
>     > @@ -373,19 +323,19 @@ int main(int argc, char **argv)
>     >                       break;
>     >               case 'r':
>     >                       opts.namespace = 1;
>     > -                     add_extra(optarg, 1);
>     > +                     add_path_and_deps(optarg, 1, 0);
>     >                       break;
>     >               case 'w':
>     >                       opts.namespace = 1;
>     > -                     add_extra(optarg, 0);
>     > +                     add_path_and_deps(optarg, 0, 0);
>     >                       break;
>     >               case 'u':
>     >                       opts.namespace = 1;
>     > -                     add_extra(ubus, 0);
>     > +                     add_path_and_deps(ubus, 0, -1);
>     >                       break;
>     >               case 'l':
>     >                       opts.namespace = 1;
>     > -                     add_extra(log, 0);
>     > +                     add_path_and_deps(log, 0, -1);
>     >                       break;
>     >               }
>     >       }
>     > diff --git a/jail/jail.h b/jail/jail.h
>     > new file mode 100644
>     > index 0000000..fc69ef6
>     > --- /dev/null
>     > +++ b/jail/jail.h
>     > @@ -0,0 +1,18 @@
>     > +/*
>     > + * Copyright (C) 2015 Etienne Champetier
>     <champetier.etienne@gmail.com <mailto:champetier.etienne@gmail.com>>
>     > + *
>     > + * This program is free software; you can redistribute it and/or
>     modify
>     > + * it under the terms of the GNU Lesser General Public License
>     version 2.1
>     > + * as published by the Free Software Foundation
>     > + *
>     > + * This program is distributed in the hope that it will be useful,
>     > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>     > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>     > + * GNU General Public License for more details.
>     > + */
>     > +
>     > +#ifndef _JAIL_H__
>     > +
>     > +int mount_bind(const char *root, const char *path, int readonly,
>     int error);
>     > +
>     > +#endif
>     >
>     _______________________________________________
>     openwrt-devel mailing list
>     openwrt-devel@lists.openwrt.org <mailto:openwrt-devel@lists.openwrt.org>
>     https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
> 
> 
> 
> 
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel@lists.openwrt.org
> https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
>

Hello,

John Crispin <blogic@openwrt.org> writes:
> // is c++
>
> /* this is the c version */

Strictly speaking, // is a valid way to add one-line comments since C99.

On 21/11/2015 20:50, Paul Fertser wrote:
> Hello,
> 
> John Crispin <blogic@openwrt.org> writes:
>> // is c++
>>
>> /* this is the c version */
> 
> Strictly speaking, // is a valid way to add one-line comments since C99.
> 

ok, let me be more precise. the code style of procd forbids this ;)