[OpenWrt-Devel,procd,4/4] ujail: rework fs jail part

this patch:
-add script (#!) dependencies detection (we add interpreter and it's dependencies)
-add dependencies detection for all files added with -r or -w (ELF and scripts)
-use PATH_MAX for path related buffers
-check magic ELF header before trying to parse the file
-search in /lib before /lib64
-add ELF interpreter (DT_INTERP)

we still don't handle
-DT_RPATH, DT_RUNPATH, nodeflib, ...
see http://man7.org/linux/man-pages/man8/ld.so.8.html
-musl ld conf file
-coffee :)

quickly run tested on DD r47603 (x86_64 kvm) and ubuntu
not tested yet on CC

should fix
https://dev.openwrt.org/ticket/20785

Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
---
 CMakeLists.txt |   2 +-
 jail/elf.c     | 132 +++++++++++++++---------------------------
 jail/elf.h     |   9 ++-
 jail/fs.c      | 179 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 jail/fs.h      |  20 +++++++
 jail/jail.c    | 112 +++++++++++-------------------------
 jail/jail.h    |  18 ++++++
 jail/log.h     |   1 +
 8 files changed, 303 insertions(+), 170 deletions(-)
 create mode 100644 jail/fs.c
 create mode 100644 jail/fs.h
 create mode 100644 jail/jail.h

I think this one needs to be split up. there are pile of different
changes contained.

	John

On 23/11/2015 01:39, Etienne CHAMPETIER wrote:
> this patch:
> -add script (#!) dependencies detection (we add interpreter and it's dependencies)
> -add dependencies detection for all files added with -r or -w (ELF and scripts)
> -use PATH_MAX for path related buffers
> -check magic ELF header before trying to parse the file
> -search in /lib before /lib64
> -add ELF interpreter (DT_INTERP)
> 
> we still don't handle
> -DT_RPATH, DT_RUNPATH, nodeflib, ...
> see http://man7.org/linux/man-pages/man8/ld.so.8.html
> -musl ld conf file
> -coffee :)
> 
> quickly run tested on DD r47603 (x86_64 kvm) and ubuntu
> not tested yet on CC
> 
> should fix
> https://dev.openwrt.org/ticket/20785
> 
> Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
> ---
>  CMakeLists.txt |   2 +-
>  jail/elf.c     | 132 +++++++++++++++---------------------------
>  jail/elf.h     |   9 ++-
>  jail/fs.c      | 179 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>  jail/fs.h      |  20 +++++++
>  jail/jail.c    | 112 +++++++++++-------------------------
>  jail/jail.h    |  18 ++++++
>  jail/log.h     |   1 +
>  8 files changed, 303 insertions(+), 170 deletions(-)
>  create mode 100644 jail/fs.c
>  create mode 100644 jail/fs.h
>  create mode 100644 jail/jail.h
> 
> diff --git a/CMakeLists.txt b/CMakeLists.txt
> index d749c25..2718125 100644
> --- a/CMakeLists.txt
> +++ b/CMakeLists.txt
> @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)
>  endif()
>  
>  IF(JAIL_SUPPORT)
> -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)
> +ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/fs.c jail/capabilities.c)
>  TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)
>  INSTALL(TARGETS ujail
>  	RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
> diff --git a/jail/elf.c b/jail/elf.c
> index a26aa0b..c8d1221 100644
> --- a/jail/elf.c
> +++ b/jail/elf.c
> @@ -12,26 +12,25 @@
>   */
>  
>  #define _GNU_SOURCE
> -#include <sys/mman.h>
>  
> -#include <stdlib.h>
> -#include <unistd.h>
> -#include <stdio.h>
>  #include <string.h>
>  #include <sys/stat.h>
>  #include <fcntl.h>
> -#include <libgen.h>
>  #include <glob.h>
>  #include <elf.h>
> +#include <assert.h>
> +#include <linux/limits.h>
>  
>  #include <libubox/utils.h>
>  
> +#include "fs.h"
>  #include "elf.h"
> +#include "log.h"
>  
>  struct avl_tree libraries;
>  static LIST_HEAD(library_paths);
>  
> -void alloc_library_path(const char *path)
> +static void alloc_library_path(const char *path)
>  {
>  	struct stat s;
>  	if (stat(path, &s))
> @@ -51,7 +50,11 @@ void alloc_library_path(const char *path)
>  	DEBUG("adding ld.so path %s\n", path);
>  }
>  
> -static void alloc_library(const char *path, const char *name)
> +/*
> + * path = full path
> + * name = soname/avl key
> + */
> +void alloc_library(const char *path, const char *name)
>  {
>  	struct library *l;
>  	char *_name, *_path;
> @@ -66,52 +69,39 @@ static void alloc_library(const char *path, const char *name)
>  	l->path = strcpy(_path, path);
>  
>  	avl_insert(&libraries, &l->avl);
> -	DEBUG("adding library %s/%s\n", path, name);
> +	DEBUG("adding library %s (%s)\n", path, name);
>  }
>  
> -static int elf_open(char **dir, const char *file)
> +int elf_open(char **fullpath, const char *file)
>  {
> +	*fullpath = NULL;
> +	assert(file[0] != '/');
> +
>  	struct library_path *p;
> -	char path[256];
> +	char path[PATH_MAX];
>  	int fd = -1;
>  
> -	*dir = NULL;
> -
>  	list_for_each_entry(p, &library_paths, list) {
> -		if (strlen(p->path))
> -			snprintf(path, sizeof(path), "%s/%s", p->path, file);
> -		else
> -			strncpy(path, file, sizeof(path));
> +		snprintf(path, sizeof(path), "%s/%s", p->path, file);
>  		fd = open(path, O_RDONLY);
>  		if (fd >= 0) {
> -			*dir = p->path;
> +			*fullpath = strdup(path);
>  			break;
>  		}
>  	}
>  
> -	if (fd == -1)
> -		fd = open(file, O_RDONLY);
> -
>  	return fd;
>  }
>  
>  char* find_lib(const char *file)
>  {
>  	struct library *l;
> -	static char path[256];
> -	const char *p;
>  
>  	l = avl_find_element(&libraries, file, l, avl);
>  	if (!l)
>  		return NULL;
>  
> -	p = l->path;
> -	if (strstr(p, "local"))
> -		p = "/lib";
> -
> -	snprintf(path, sizeof(path), "%s/%s", p, file);
> -
> -	return path;
> +	return l->path;
>  }
>  
>  static int elf64_find_section(const char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
> @@ -201,7 +191,7 @@ static int elf32_scan_dynamic(const char *map, int dyn_offset, int dyn_size, int
>  		if (curr->d_tag != DT_NEEDED)
>  			continue;
>  
> -		if (elf_load_deps(&strtab[curr->d_un.d_val]))
> +		if (add_path_and_deps(&strtab[curr->d_un.d_val], 1, -1, 1) == -1)
>  			return -1;
>  	}
>  
> @@ -235,85 +225,48 @@ static int elf64_scan_dynamic(const char *map, int dyn_offset, int dyn_size, int
>  		if (curr->d_tag != DT_NEEDED)
>  			continue;
>  
> -		if (elf_load_deps(&strtab[curr->d_un.d_val]))
> +		if (add_path_and_deps(&strtab[curr->d_un.d_val], 1, -1, 1) == -1)
>  			return -1;
>  	}
>  
>  	return 0;
>  }
>  
> -int elf_load_deps(const char *library)
> +int elf_load_deps(const char *path, const char *map)
>  {
>  	unsigned int dyn_offset, dyn_size;
>  	unsigned int load_offset, load_vaddr;
> -	struct stat s;
> -	char *map = NULL, *dir = NULL;
> -	int clazz, fd, ret = -1;
> -
> -	if (avl_find(&libraries, library))
> -		return 0;
> -
> -	fd = elf_open(&dir, library);
> -
> -	if (fd < 0) {
> -		ERROR("failed to open %s\n", library);
> -		return -1;
> -	}
> -
> -	if (fstat(fd, &s) == -1) {
> -		ERROR("failed to stat %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> -
> -	map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
> -	if (map == MAP_FAILED) {
> -		ERROR("failed to mmap %s\n", library);
> -		ret = -1;
> -		goto err_out;
> -	}
> +	unsigned int interp_offset;
>  
>  	if (elf_find_section(map, PT_LOAD, &load_offset, NULL, &load_vaddr)) {
> -		ERROR("failed to load the .load section from %s\n", library);
> -		ret = -1;
> -		goto err_out;
> +		ERROR("failed to load the .load section from %s\n", path);
> +		return -1;
>  	}
>  
>  	if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size, NULL)) {
> -		ERROR("failed to load the .dynamic section from %s\n", library);
> -		ret = -1;
> -		goto err_out;
> +		ERROR("failed to load the .dynamic section from %s\n", path);
> +		return -1;
>  	}
>  
> -	if (dir) {
> -		alloc_library(dir, library);
> -	} else {
> -		char *elf1 = strdup(library);
> -		char *elf2 = strdup(library);
> -
> -		alloc_library(dirname(elf1), basename(elf2));
> -		free(elf1);
> -		free(elf2);
> +	if (elf_find_section(map, PT_INTERP, &interp_offset, NULL, NULL) == 0) {
> +		add_path_and_deps(map+interp_offset, 1, -1, 0);
>  	}
> -	clazz = map[EI_CLASS];
> +
> +	int clazz = map[EI_CLASS];
>  
>  	if (clazz == ELFCLASS32)
> -		ret = elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
> +		return elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
>  	else if (clazz == ELFCLASS64)
> -		ret = elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
> -
> -err_out:
> -	if (map)
> -		munmap(map, s.st_size);
> -	close(fd);
> +		return elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
>  
> -	return ret;
> +	ERROR("unknown elf format %d\n", clazz);
> +	return -1;
>  }
>  
> -void load_ldso_conf(const char *conf)
> +static void load_ldso_conf(const char *conf)
>  {
>  	FILE* fp = fopen(conf, "r");
> -	char line[256];
> +	char line[PATH_MAX];
>  
>  	if (!fp) {
>  		DEBUG("failed to open %s\n", conf);
> @@ -323,7 +276,7 @@ void load_ldso_conf(const char *conf)
>  	while (!feof(fp)) {
>  		int len;
>  
> -		if (!fgets(line, 256, fp))
> +		if (!fgets(line, sizeof(line), fp))
>  			break;
>  		len = strlen(line);
>  		if (len < 2)
> @@ -355,3 +308,12 @@ void load_ldso_conf(const char *conf)
>  
>  	fclose(fp);
>  }
> +
> +void init_library_path(void)
> +{
> +	avl_init(&libraries, avl_strcmp, false, NULL);
> +	alloc_library_path("/lib");
> +	alloc_library_path("/lib64");
> +	alloc_library_path("/usr/lib");
> +	load_ldso_conf("/etc/ld.so.conf");
> +}
> diff --git a/jail/elf.h b/jail/elf.h
> index 6c14c39..ea67837 100644
> --- a/jail/elf.h
> +++ b/jail/elf.h
> @@ -15,8 +15,6 @@
>  #include <libubox/avl.h>
>  #include <libubox/avl-cmp.h>
>  
> -#include "log.h"
> -
>  struct library {
>  	struct avl_node avl;
>  	char *name;
> @@ -30,9 +28,10 @@ struct library_path {
>  
>  struct avl_tree libraries;
>  
> -void alloc_library_path(const char *path);
> -int elf_load_deps(const char *library);
> +void alloc_library(const char *path, const char *name);
> +int elf_open(char **fullpath, const char *file);
> +int elf_load_deps(const char *path, const char *map);
>  char* find_lib(const char *file);
> -void load_ldso_conf(const char *conf);
> +void init_library_path(void);
>  
>  #endif
> diff --git a/jail/fs.c b/jail/fs.c
> new file mode 100644
> index 0000000..c1ae1da
> --- /dev/null
> +++ b/jail/fs.c
> @@ -0,0 +1,179 @@
> +/*
> + * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#define _GNU_SOURCE
> +
> +#include <assert.h>
> +#include <elf.h>
> +#include <errno.h>
> +#include <fcntl.h>
> +#include <linux/limits.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/stat.h>
> +#include <sys/mman.h>
> +#include <unistd.h>
> +
> +#include <libubox/avl.h>
> +#include <libubox/avl-cmp.h>
> +
> +#include "elf.h"
> +#include "fs.h"
> +#include "jail.h"
> +#include "log.h"
> +
> +struct mount {
> +        struct avl_node avl;
> +        const char *path;
> +        int readonly;
> +        int error;
> +};
> +
> +struct avl_tree mounts;
> +
> +static int add_mount(const char *path, int readonly, int error)
> +{
> +	if (avl_find(&mounts, path))
> +		return 1;
> +
> +	struct mount *m;
> +	m = calloc(1, sizeof(struct mount));
> +	assert(m != NULL);
> +	m->avl.key = m->path = strdup(path);
> +	m->readonly = readonly;
> +	m->error = error;
> +
> +	avl_insert(&mounts, &m->avl);
> +	DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly, m->error != 0);
> +	return 0;
> +}
> +
> +int mount_all(const char *jailroot) {
> +	struct library *l;
> +	struct mount *m;
> +
> +	avl_for_each_element(&libraries, l, avl)
> +		add_mount(l->path, 1, -1);
> +
> +	avl_for_each_element(&mounts, m, avl)
> +		if (mount_bind(jailroot, m->path, m->readonly, m->error))
> +			return -1;
> +
> +	return 0;
> +}
> +
> +void mount_list_init(void) {
> +	avl_init(&mounts, avl_strcmp, false, NULL);
> +}
> +
> +static int add_script_interp(const char *path, const char *map, int size)
> +{
> +	int start = 2;
> +	while (start < size && map[start] != '/') {
> +		start++;
> +	}
> +	if (start >= size) {
> +		ERROR("bad script interp (%s)", path);
> +		return -1;
> +	}
> +	int stop = start + 1;
> +	while (stop < size && map[stop] > 0x20 && map[stop] <= 0x7e) {
> +		stop++;
> +	}
> +	if (stop >= size || (stop-start) > PATH_MAX) {
> +		ERROR("bad script interp (%s)", path);
> +		return -1;
> +	}
> +	char buf[PATH_MAX];
> +	strncpy(buf, map+start, stop-start);
> +	return add_path_and_deps(buf, 1, -1, 0);
> +}
> +
> +int add_path_and_deps(const char *path, int readonly, int error, int lib)
> +{
> +	assert(path != NULL);
> +
> +	if (lib == 0 && path[0] != '/') {
> +		ERROR("%s is not an absolute path\n", path);
> +		return error;
> +	}
> +
> +	char *map = NULL;
> +	int fd, ret = -1;
> +	if (path[0] == '/') {
> +		if (avl_find(&mounts, path))
> +			return 0;
> +		fd = open(path, O_RDONLY);
> +		if (fd == -1)
> +			return error;
> +		add_mount(path, readonly, error);
> +	} else {
> +		if (avl_find(&libraries, path))
> +			return 0;
> +		char *fullpath;
> +		fd = elf_open(&fullpath, path);
> +		if (fd == -1)
> +			return error;
> +		if (fullpath) {
> +			alloc_library(fullpath, path);
> +			free(fullpath);
> +		}
> +	}
> +
> +	struct stat s;
> +	if (fstat(fd, &s) == -1) {
> +		ERROR("fstat(%s) failed: %s\n", path, strerror(errno));
> +		ret = error;
> +		goto out;
> +	}
> +
> +	if (!S_ISREG(s.st_mode)) {
> +		ret = 0;
> +		goto out;
> +	}
> +
> +	/* too small to be an ELF or a script */
> +	if (s.st_size < 4) {
> +		ret = 0;
> +		goto out;
> +	}
> +
> +	map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
> +	if (map == MAP_FAILED) {
> +		ERROR("failed to mmap %s\n", path);
> +		ret = -1;
> +		goto out;
> +	}
> +
> +	if (map[0] == '#' && map[1] == '!') {
> +		ret = add_script_interp(path, map, s.st_size);
> +		goto out;
> +	}
> +
> +	if (map[0] == ELFMAG0 && map[1] == ELFMAG1 && map[2] == ELFMAG2 && map[3] == ELFMAG3) {
> +		ret = elf_load_deps(path, map);
> +		goto out;
> +	}
> +
> +	ret = 0;
> +
> +out:
> +	if (fd >= 0)
> +		close(fd);
> +	if (map)
> +		munmap(map, s.st_size);
> +
> +	return ret;
> +}
> +
> diff --git a/jail/fs.h b/jail/fs.h
> new file mode 100644
> index 0000000..0839d5c
> --- /dev/null
> +++ b/jail/fs.h
> @@ -0,0 +1,20 @@
> +/*
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#ifndef _FS_H__
> +
> +int add_path_and_deps(const char *path, int readonly, int error, int lib);
> +int mount_all(const char *jailroot);
> +void mount_list_init(void);
> +
> +#endif
> diff --git a/jail/jail.c b/jail/jail.c
> index 08babde..db74504 100644
> --- a/jail/jail.c
> +++ b/jail/jail.c
> @@ -18,19 +18,20 @@
>  
>  #include <stdlib.h>
>  #include <unistd.h>
> -#include <values.h>
>  #include <errno.h>
> -#include <stdio.h>
>  #include <string.h>
>  #include <sys/stat.h>
>  #include <fcntl.h>
>  #include <libgen.h>
>  #include <sched.h>
> +#include <linux/limits.h>
>  
> -#include "elf.h"
>  #include "capabilities.h"
> +#include "elf.h"
> +#include "fs.h"
> +#include "jail.h"
> +#include "log.h"
>  
> -#include <libubox/list.h>
>  #include <libubox/uloop.h>
>  
>  #define STACK_SIZE	(1024 * 1024)
> @@ -48,16 +49,6 @@ static struct {
>  	int sysfs;
>  } opts;
>  
> -struct extra {
> -	struct list_head list;
> -
> -	const char *path;
> -	const char *name;
> -	int readonly;
> -};
> -
> -static LIST_HEAD(extras);
> -
>  extern int pivot_root(const char *new_root, const char *put_old);
>  
>  int debug = 0;
> @@ -89,32 +80,23 @@ static int mkdir_p(char *dir, mode_t mask)
>  	return ret;
>  }
>  
> -static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error)
> +int mount_bind(const char *root, const char *path, int readonly, int error)
>  {
> -	const char *p = path;
>  	struct stat s;
> -	char old[256];
> -	char new[256];
> +	char new[PATH_MAX];
>  	int fd;
>  
> -	if (strstr(p, "local"))
> -		p = "/lib";
> -
> -	snprintf(old, sizeof(old), "%s/%s", path, name);
> -	snprintf(new, sizeof(new), "%s%s", root, p);
> -
> -	mkdir_p(new, 0755);
> -
> -	snprintf(new, sizeof(new), "%s%s/%s", root, p, name);
> -
> -	if (stat(old, &s)) {
> -		ERROR("%s does not exist\n", old);
> +	if (stat(path, &s)) {
> +		ERROR("%s does not exist\n", path);
>  		return error;
>  	}
>  
> +	snprintf(new, sizeof(new), "%s%s", root, path);
>  	if (S_ISDIR(s.st_mode)) {
>  		mkdir_p(new, 0755);
>  	} else {
> +		mkdir_p(dirname(new), 0755);
> +		snprintf(new, sizeof(new), "%s%s", root, path);
>  		fd = creat(new, 0644);
>  		if (fd == -1) {
>  			ERROR("failed to create %s: %s\n", new, strerror(errno));
> @@ -123,8 +105,8 @@ static int mount_bind(const char *root, const char *path, const char *name, int
>  		close(fd);
>  	}
>  
> -	if (mount(old, new, NULL, MS_BIND, NULL)) {
> -		ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno));
> +	if (mount(path, new, NULL, MS_BIND, NULL)) {
> +		ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno));
>  		return -1;
>  	}
>  
> @@ -133,16 +115,13 @@ static int mount_bind(const char *root, const char *path, const char *name, int
>  		return -1;
>  	}
>  
> -	DEBUG("mount -B %s %s\n", old, new);
> +	DEBUG("mount -B %s %s\n", path, new);
>  
>  	return 0;
>  }
>  
> -static int build_jail_fs()
> +static int build_jail_fs(void)
>  {
> -	struct library *l;
> -	struct extra *m;
> -
>  	if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) {
>  		ERROR("tmpfs mount failed %s\n", strerror(errno));
>  		return -1;
> @@ -153,29 +132,20 @@ static int build_jail_fs()
>  		return -1;
>  	}
>  
> -	avl_init(&libraries, avl_strcmp, false, NULL);
> -	alloc_library_path("/lib64");
> -	alloc_library_path("/lib");
> -	alloc_library_path("/usr/lib");
> -	load_ldso_conf("/etc/ld.so.conf");
> -
> -	if (elf_load_deps(*opts.jail_argv)) {
> +	if (add_path_and_deps(*opts.jail_argv, 1, -1, 0)) {
>  		ERROR("failed to load dependencies\n");
>  		return -1;
>  	}
>  
> -	if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {
> +	if (opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) {
>  		ERROR("failed to load libpreload-seccomp.so\n");
>  		return -1;
>  	}
>  
> -	avl_for_each_element(&libraries, l, avl)
> -		if (mount_bind(opts.path, l->path, l->name, 1, -1))
> -			return -1;
> -
> -	list_for_each_entry(m, &extras, list)
> -		if (mount_bind(opts.path, m->path, m->name, m->readonly, 0))
> -			return -1;
> +	if (mount_all(opts.path)) {
> +		ERROR("mount_all() failed\n");
> +		return -1;
> +	}
>  
>  	char *mpoint;
>  	if (asprintf(&mpoint, "%s/old", opts.path) < 0) {
> @@ -209,8 +179,8 @@ static int build_jail_fs()
>  static char** build_envp(const char *seccomp)
>  {
>  	static char *envp[MAX_ENVP];
> -	static char preload_var[64];
> -	static char seccomp_var[64];
> +	static char preload_var[PATH_MAX];
> +	static char seccomp_var[PATH_MAX];
>  	static char debug_var[] = "LD_DEBUG=all";
>  	char *preload_lib = find_lib("libpreload-seccomp.so");
>  	int count = 0;
> @@ -256,7 +226,7 @@ ujail will not use namespace/build a jail,\n\
>  and will only drop capabilities/apply seccomp filter.\n\n");
>  }
>  
> -static int exec_jail()
> +static int exec_jail(void)
>  {
>  	char **envp = build_envp(opts.seccomp);
>  	if (!envp)
> @@ -306,24 +276,6 @@ static struct uloop_process jail_process = {
>  	.cb = jail_process_handler,
>  };
>  
> -static void add_extra(char *name, int readonly)
> -{
> -	struct extra *f;
> -
> -	if (*name != '/') {
> -		ERROR("%s is not an absolute path\n", name);
> -		return;
> -	}
> -
> -	f = calloc(1, sizeof(struct extra));
> -
> -	f->name = basename(name);
> -	f->path = dirname(strdup(name));
> -	f->readonly = readonly;
> -
> -	list_add_tail(&f->list, &extras);
> -}
> -
>  int main(int argc, char **argv)
>  {
>  	uid_t uid = getuid();
> @@ -338,6 +290,8 @@ int main(int argc, char **argv)
>  	}
>  
>  	umask(022);
> +	mount_list_init();
> +	init_library_path();
>  
>  	while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
>  		switch (ch) {
> @@ -358,11 +312,11 @@ int main(int argc, char **argv)
>  			break;
>  		case 'S':
>  			opts.seccomp = optarg;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, -1, 0);
>  			break;
>  		case 'C':
>  			opts.capabilities = optarg;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, -1, 0);
>  			break;
>  		case 'P':
>  			opts.namespace = 1;
> @@ -373,19 +327,19 @@ int main(int argc, char **argv)
>  			break;
>  		case 'r':
>  			opts.namespace = 1;
> -			add_extra(optarg, 1);
> +			add_path_and_deps(optarg, 1, 0, 0);
>  			break;
>  		case 'w':
>  			opts.namespace = 1;
> -			add_extra(optarg, 0);
> +			add_path_and_deps(optarg, 0, 0, 0);
>  			break;
>  		case 'u':
>  			opts.namespace = 1;
> -			add_extra(ubus, 0);
> +			add_path_and_deps(ubus, 0, -1, 0);
>  			break;
>  		case 'l':
>  			opts.namespace = 1;
> -			add_extra(log, 0);
> +			add_path_and_deps(log, 0, -1, 0);
>  			break;
>  		}
>  	}
> diff --git a/jail/jail.h b/jail/jail.h
> new file mode 100644
> index 0000000..fc69ef6
> --- /dev/null
> +++ b/jail/jail.h
> @@ -0,0 +1,18 @@
> +/*
> + * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU Lesser General Public License version 2.1
> + * as published by the Free Software Foundation
> + *
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + * GNU General Public License for more details.
> + */
> +
> +#ifndef _JAIL_H__
> +
> +int mount_bind(const char *root, const char *path, int readonly, int error);
> +
> +#endif
> diff --git a/jail/log.h b/jail/log.h
> index b1d201e..e56fc6a 100644
> --- a/jail/log.h
> +++ b/jail/log.h
> @@ -12,6 +12,7 @@
>   */
>  
>  extern int debug;
> +#include <stdio.h>
>  #include <syslog.h>
>  
>  #define INFO(fmt, ...) do { \
>