3 · Namespaces e rootfs#

/// Mapeamento de um só uid/gid (root dentro = o teu utilizador fora). Para vários uids seria
/// preciso `newuidmap` + `/etc/subuid`.
fn map_ids(uid: nix::unistd::Uid, gid: nix::unistd::Gid) -> Result<()> {
    let w = |f: &str, v: String| {
        fs::write(format!("/proc/self/{f}"), v).ctx(|| format!("writing /proc/self/{f}"))
    };
    w("setgroups", "deny".into())?; // obrigatório antes do gid_map sem privilégio
    w("uid_map", format!("0 {uid} 1"))?;
    w("gid_map", format!("0 {gid} 1"))
}

/// Sobe `lo` no netns novo (ioctl SIOCSIFFLAGS). Sem isto `127.0.0.1` não responde.
fn loopback_up() -> Result<()> {
    // SAFETY: `ifreq` é POD de zeros válido; o socket é fechado no fim; nomes ≤ IFNAMSIZ.
    unsafe {
        let sock = libc::socket(libc::AF_INET, libc::SOCK_DGRAM | libc::SOCK_CLOEXEC, 0);
        if sock < 0 {
            return Err(Error::Sys(nix::Error::last()));
        }
        let mut ifr: libc::ifreq = std::mem::zeroed();
        for (d, s) in ifr.ifr_name.iter_mut().zip(b"lo\0") {
            *d = *s as libc::c_char;
        }
        ifr.ifr_ifru.ifru_flags = (libc::IFF_UP | libc::IFF_RUNNING) as libc::c_short;
        let rc = libc::ioctl(sock, libc::SIOCSIFFLAGS as _, &ifr);
        let err = nix::Error::last();
        libc::close(sock);
        if rc < 0 { Err(Error::Sys(err)) } else { Ok(()) }
    }
}

/// PID 1 do container. Só regressa com erro — no sucesso faz `exec`.
fn container_init(
    spec: &Spec,
    rootfs: &Path,
    fifo: &Path,
    report: &OwnedFd,
) -> Result<std::convert::Infallible> {
    unshare(CloneFlags::CLONE_NEWNS)?;
    // Sem isto os nossos mounts propagavam para o host.
    mount(None::<&str>, "/", None::<&str>, MsFlags::MS_REC | MsFlags::MS_PRIVATE, None::<&str>)?;
    // pivot_root exige que o novo root seja um ponto de montagem.
    mount(Some(rootfs), rootfs, None::<&str>, MsFlags::MS_BIND | MsFlags::MS_REC, None::<&str>)?;

    let mut dev_mounted = false;
    for m in &spec.mounts {
        apply_mount(rootfs, m)?;
        dev_mounted |= m.destination == Path::new("/dev");
    }
    if dev_mounted {
        setup_dev(rootfs)?;
    }

    // Aberto ANTES do pivot: depois dele o caminho do FIFO já não existe.
    // O_RDWR não bloqueia na abertura; o `read` bloqueia até `start` escrever.
    let fifo_fd = nix::fcntl::open(fifo, OFlag::O_RDWR | OFlag::O_CLOEXEC, Mode::empty())?;

    chdir(rootfs)?;
    pivot_root(".", ".")?; // truque: raiz nova e antiga empilhadas no mesmo sítio…
    umount2(".", MntFlags::MNT_DETACH)?; // …e a antiga desmonta-se.
    chdir("/")?;
    if spec.root.readonly {
        remount_ro("/")?;
    }
    if let Some(h) = &spec.hostname {
        sethostname(h)?;
    }
    drop_capabilities()?;
    // SAFETY: prctl com argumentos inteiros constantes.
    if unsafe { libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) } != 0 {
        return Err(Error::Sys(nix::Error::last()));
    }

    // Tudo pronto: diz ao supervisor e espera pelo `start`.
    send(report, b"K");
    let mut byte = [0u8; 1];
    nix::unistd::read(&fifo_fd, &mut byte)?;
    drop(fifo_fd);

    chdir(spec.process.cwd.as_str())?;
    let args: Vec<CString> = spec.process.args.iter().map(|a| cstr(a)).collect::<Result<_>>()?;
    let env: Vec<CString> = spec.process.env.iter().map(|a| cstr(a)).collect::<Result<_>>()?;
    let err = nix::unistd::execvpe(&args[0], &args, &env).unwrap_err();
    // Já depois do `start`: o relatório fechou; diz-se no stderr e sai-se como a shell (127).
    eprintln!("mc: cannot exec {:?}: {err}", spec.process.args[0]);
    std::process::exit(if err == nix::Error::ENOENT { 127 } else { 126 });
}

fn apply_mount(rootfs: &Path, m: &Mount) -> Result<()> {
    let target = resolve_in_root(rootfs, &m.destination, true)?;
    let (mut flags, mut ro) = (MsFlags::empty(), false);
    let mut data: Vec<&str> = Vec::new();
    for o in &m.options {
        match o.as_str() {
            "ro" => ro = true,
            "nosuid" => flags |= MsFlags::MS_NOSUID,
            "nodev" => flags |= MsFlags::MS_NODEV,
            "noexec" => flags |= MsFlags::MS_NOEXEC,
            "bind" => flags |= MsFlags::MS_BIND,
            "rbind" => flags |= MsFlags::MS_BIND | MsFlags::MS_REC,
            "rw" | "relatime" | "strictatime" => {}
            other => data.push(other),
        }
    }
    let kind = m.kind.as_deref().unwrap_or("bind");
    let bind = kind == "bind" || flags.contains(MsFlags::MS_BIND);
    match kind {
        "proc" | "tmpfs" | "bind" => {}
        other => return Err(Error::Unsupported(format!("mount type {other:?}"))),
    }
    let source = m.source.as_deref();
    if bind {
        let src = source.ok_or_else(|| Error::Spec("bind mount without source".into()))?;
        if src.is_file() {
            // o alvo de um bind de ficheiro tem de ser um ficheiro
            fs::remove_dir(&target).ok();
            fs::File::create(&target).ctx(|| format!("creating {}", target.display()))?;
        }
        mount(Some(src), &target, None::<&str>, flags | MsFlags::MS_BIND, None::<&str>)?;
        if ro || !(flags - MsFlags::MS_BIND - MsFlags::MS_REC).is_empty() {
            let t = target.to_string_lossy();
            let mut f = MsFlags::MS_BIND | MsFlags::MS_REMOUNT | flags | inherited_flags(&t);
            if ro {
                f |= MsFlags::MS_RDONLY
            }
            mount(None::<&str>, &target, None::<&str>, f, None::<&str>)?;
        }
    } else {
        let data = data.join(",");
        if ro {
            flags |= MsFlags::MS_RDONLY
        }
        mount(source, &target, Some(kind), flags, if data.is_empty() { None } else { Some(data.as_str()) })?;
    }
    Ok(())
}

/// Junta `rel` a `root` recusando `..`, prefixos e — sobretudo — **symlinks** pelo caminho.
///
/// Porque não basta `root.join(rel)`: uma imagem pode plantar `etc -> /` e um bind mount
/// para `etc/passwd` acabaria no `/` do *host*. Resolvemos componente a componente e
/// recusamos qualquer symlink (é o que o delonix faz em `safe_bind_target`).
/// Com `create`, os directórios que faltam são criados.
pub fn resolve_in_root(root: &Path, rel: &Path, create: bool) -> Result<PathBuf> {
    let mut cur = root.to_path_buf();
    for comp in rel.components() {
        match comp {
            Component::RootDir | Component::CurDir => {}
            Component::Normal(name) => {
                cur.push(name);
                match fs::symlink_metadata(&cur) {
                    Ok(meta) if meta.file_type().is_symlink() => {
                        return Err(Error::UnsafePath(cur));
                    }
                    Ok(_) => {}
                    Err(e) if e.kind() == std::io::ErrorKind::NotFound && create => {
                        fs::create_dir(&cur).ctx(|| format!("creating {}", cur.display()))?;
                    }
                    Err(e) => return Err(Error::io(format!("stat {}", cur.display()), e)),
                }
            }
            Component::ParentDir | Component::Prefix(_) => {
                return Err(Error::UnsafePath(rel.to_path_buf()));
            }
        }
    }
    Ok(cur)
}

/// Resolves `target` (an in-container path, already lexically validated by
/// `mount_target_safe`) against `rootfs`, component-by-component, refusing to
/// descend through any symlink an image layer may have planted along the
/// way. `mount_target_safe`'s lexical `..` check is not enough on its own:
/// `create_dir_all`/`OpenOptions::open` (called on the joined path right
/// after this) FOLLOW symlinks, and `bind_volume` runs BEFORE `pivot_root`
/// while `/` is still the real host filesystem — an absolute symlink at ANY
/// path component (a malicious image shipping e.g. `/etc -> /root`, or the
/// final mount-target component itself already existing as one) redirects
/// the destination to an arbitrary real host path, and the subsequent
/// create/open then create real directories/files on the host, as the
/// engine's own uid. Mirrors the confinement technique `cmd::build::
/// confine_to` already uses for the build's COPY (a sibling of this exact
/// bug class, fixed there first) — this is the engine-side equivalent.
fn safe_bind_target(rootfs: &str, target: &str) -> Option<std::path::PathBuf> {
    let mut current = std::path::PathBuf::from(rootfs);
    for comp in std::path::Path::new(target).components() {
        let std::path::Component::Normal(c) = comp else {
            continue;
        };
        current.push(c);
        if let Ok(meta) = std::fs::symlink_metadata(&current) {
            if meta.file_type().is_symlink() {
                return None;
            }
        }
    }
    Some(current)
}

/// Sem root não há `mknod`: os dispositivos básicos são *bind-mounts* dos do host.
fn setup_dev(rootfs: &Path) -> Result<()> {
    let dev = resolve_in_root(rootfs, Path::new("/dev"), false)?; // sem symlinks pelo caminho
    for name in ["null", "zero", "full", "random", "urandom", "tty"] {
        let target = dev.join(name);
        fs::File::create(&target).ctx(|| format!("creating {}", target.display()))?;
        mount(
            Some(&*PathBuf::from("/dev").join(name)),
            &target,
            None::<&str>,
            MsFlags::MS_BIND,
            None::<&str>,
        )?;
    }
    for (link, to) in [
        ("fd", "/proc/self/fd"),
        ("stdin", "/proc/self/fd/0"),
        ("stdout", "/proc/self/fd/1"),
        ("stderr", "/proc/self/fd/2"),
    ] {
        std::os::unix::fs::symlink(to, dev.join(link)).ctx(|| format!("symlink /dev/{link}"))?;
    }
    Ok(())
}