exec: introduce PrivateNetwork= process option to turn off network access to specific services

10 files changed, 59 insertions, 20 deletions

diff --git a/TODO b/TODO
index eb3f6b8797..7f2d5e6fa5 100644
--- a/TODO
+++ b/TODO
@@ -19,6 +19,8 @@ Bugfixes:
 
 Features:
 
+* hide PAM/TCPWrap options in fragment parser when compile time disabled
+
 * make arbitrary cgroups attributes settable
 
 * when we automatically restart a service, ensure we retsart its rdeps, too.
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 490c6c2cd5..6a0d21f0a5 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -155,7 +155,7 @@
                         </varlistentry>
 
                         <varlistentry>
-                                <term><option>--no-net</option></term>
+                                <term><option>--private-network</option></term>
 
                                 <listitem><para>Turn off networking in
                                 the container. This makes all network
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 99a91b3dfa..d28417da1c 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -783,9 +783,9 @@
                                 <term><varname>PrivateTmp=</varname></term>
 
                                 <listitem><para>Takes a boolean
-                                argument. If true sets up a new
-                                namespace for the executed processes
-                                and mounts a private
+                                argument. If true sets up a new file
+                                system namespace for the executed
+                                processes and mounts a private
                                 <filename>/tmp</filename> directory
                                 inside it, that is not shared by
                                 processes outside of the
@@ -794,7 +794,25 @@
                                 process, but makes sharing between
                                 processes via
                                 <filename>/tmp</filename>
-                                impossible. Defaults to false.</para></listitem>
+                                impossible. Defaults to
+                                false.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><varname>PrivateNetwork=</varname></term>
+
+                                <listitem><para>Takes a boolean
+                                argument. If true sets up a new
+                                network namespace for the executed
+                                processes and configures only the
+                                loopback network device
+                                <literal>lo</literal> inside it. No
+                                other network devices will be
+                                available to the executed process.
+                                This is useful to securely turn off
+                                network access by the executed
+                                process. Defaults to
+                                false.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
diff --git a/src/dbus-execute.h b/src/dbus-execute.h
index 49ad6cb82a..2e306794fe 100644
--- a/src/dbus-execute.h
+++ b/src/dbus-execute.h
@@ -92,7 +92,8 @@
         "  <property name=\"KillMode\" type=\"s\" access=\"read\"/>\n"  \
         "  <property name=\"KillSignal\" type=\"i\" access=\"read\"/>\n" \
         "  <property name=\"UtmpIdentifier\" type=\"s\" access=\"read\"/>\n" \
-        "  <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n"
+        "  <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" \
+        "  <property name=\"PrivateNetwork\" type=\"b\" access=\"read\"/>\n"
 
 #define BUS_EXEC_COMMAND_INTERFACE(name)                             \
         "  <property name=\"" name "\" type=\"a(sasbttuii)\" access=\"read\"/>\n"
@@ -151,6 +152,7 @@
         { interface, "InaccessibleDirectories",       bus_property_append_strv,   "as",    (context).inaccessible_dirs             }, \
         { interface, "MountFlags",                    bus_property_append_ul,     "t",     &(context).mount_flags                  }, \
         { interface, "PrivateTmp",                    bus_property_append_bool,   "b",     &(context).private_tmp                  }, \
+        { interface, "PrivateNetwork",                bus_property_append_bool,   "b",     &(context).private_network              }, \
         { interface, "SameProcessGroup",              bus_property_append_bool,   "b",     &(context).same_pgrp                    }, \
         { interface, "KillMode",                      bus_execute_append_kill_mode, "s",   &(context).kill_mode                    }, \
         { interface, "KillSignal",                    bus_property_append_int,    "i",     &(context).kill_signal                  }, \
diff --git a/src/execute.c b/src/execute.c
index 668bf9d0f0..c73b0c6c04 100644
--- a/src/execute.c
+++ b/src/execute.c
@@ -56,6 +56,7 @@
 #include "missing.h"
 #include "utmp-wtmp.h"
 #include "def.h"
+#include "loopback-setup.h"
 
 /* This assumes there is a 'tty' group */
 #define TTY_MODE 0620
@@ -1208,6 +1209,14 @@ int exec_spawn(ExecCommand *command,
                         }
                 }
 #endif
+                if (context->private_network) {
+                        if (unshare(CLONE_NEWNET) < 0) {
+                                r = EXIT_NETWORK;
+                                goto fail_child;
+                        }
+
+                        loopback_setup();
+                }
 
                 if (strv_length(context->read_write_dirs) > 0 ||
                     strv_length(context->read_only_dirs) > 0 ||
@@ -1594,13 +1603,15 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
                 "%sRootDirectory: %s\n"
                 "%sNonBlocking: %s\n"
                 "%sPrivateTmp: %s\n"
-                "%sControlGroupModify: %s\n",
+                "%sControlGroupModify: %s\n"
+                "%sPrivateNetwork: %s\n",
                 prefix, c->umask,
                 prefix, c->working_directory ? c->working_directory : "/",
                 prefix, c->root_directory ? c->root_directory : "/",
                 prefix, yes_no(c->non_blocking),
                 prefix, yes_no(c->private_tmp),
-                prefix, yes_no(c->control_group_modify));
+                prefix, yes_no(c->control_group_modify),
+                prefix, yes_no(c->private_network));
 
         STRV_FOREACH(e, c->environment)
                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
diff --git a/src/execute.h b/src/execute.h
index a2d9072357..b376e36a7a 100644
--- a/src/execute.h
+++ b/src/execute.h
@@ -159,6 +159,7 @@ struct ExecContext {
         bool cpu_sched_reset_on_fork;
         bool non_blocking;
         bool private_tmp;
+        bool private_network;
 
         bool control_group_modify;
 
diff --git a/src/exit-status.c b/src/exit-status.c
index 9b7c027b43..8ed1a0e362 100644
--- a/src/exit-status.c
+++ b/src/exit-status.c
@@ -116,6 +116,9 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) {
 
                 case EXIT_PAM:
                         return "PAM";
+
+                case EXIT_NETWORK:
+                        return "NETWORK";
                 }
         }
 
diff --git a/src/exit-status.h b/src/exit-status.h
index 28f03a5911..3e977b10ef 100644
--- a/src/exit-status.h
+++ b/src/exit-status.h
@@ -64,7 +64,8 @@ typedef enum ExitStatus {
         EXIT_CONFIRM,
         EXIT_STDERR,
         EXIT_TCPWRAP,
-        EXIT_PAM
+        EXIT_PAM,
+        EXIT_NETWORK
 
 } ExitStatus;
 
diff --git a/src/load-fragment-gperf.gperf.m4 b/src/load-fragment-gperf.gperf.m4
index e6d8de72a3..650f44490a 100644
--- a/src/load-fragment-gperf.gperf.m4
+++ b/src/load-fragment-gperf.gperf.m4
@@ -68,6 +68,7 @@ $1.ReadWriteDirectories,         config_parse_path_strv,             0,
 $1.ReadOnlyDirectories,          config_parse_path_strv,             0,                             offsetof($1, exec_context.read_only_dirs)
 $1.InaccessibleDirectories,      config_parse_path_strv,             0,                             offsetof($1, exec_context.inaccessible_dirs)
 $1.PrivateTmp,                   config_parse_bool,                  0,                             offsetof($1, exec_context.private_tmp)
+$1.PrivateNetwork,               config_parse_bool,                  0,                             offsetof($1, exec_context.private_network)
 $1.MountFlags,                   config_parse_exec_mount_flags,      0,                             offsetof($1, exec_context)
 $1.TCPWrapName,                  config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.tcpwrap_name)
 $1.PAMName,                      config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.pam_name)
diff --git a/src/nspawn.c b/src/nspawn.c
index c97649d386..2c1144a7f5 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -48,7 +48,7 @@
 
 static char *arg_directory = NULL;
 static char *arg_user = NULL;
-static bool arg_no_net = false;
+static bool arg_private_network = false;
 
 static int help(void) {
 
@@ -57,7 +57,7 @@ static int help(void) {
                "  -h --help            Show this help\n"
                "  -D --directory=NAME  Root directory for the container\n"
                "  -u --user=USER       Run the command under specified user or uid\n"
-               "     --no-net          Disable network  in container\n",
+               "     --private-network Disable network in container\n",
                program_invocation_short_name);
 
         return 0;
@@ -66,15 +66,15 @@ static int help(void) {
 static int parse_argv(int argc, char *argv[]) {
 
         enum {
-                ARG_NO_NET = 0x100
+                ARG_PRIVATE_NETWORK = 0x100
         };
 
         static const struct option options[] = {
-                { "help",      no_argument,       NULL, 'h'        },
-                { "directory", required_argument, NULL, 'D'        },
-                { "user",      required_argument, NULL, 'u'        },
-                { "no-net",    no_argument,       NULL, ARG_NO_NET },
-                { NULL,        0,                 NULL, 0          }
+                { "help",            no_argument,       NULL, 'h'                 },
+                { "directory",       required_argument, NULL, 'D'                 },
+                { "user",            required_argument, NULL, 'u'                 },
+                { "private-network", no_argument,       NULL, ARG_PRIVATE_NETWORK },
+                { NULL,              0,                 NULL, 0                   }
         };
 
         int c;
@@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) {
 
                         break;
 
-                case ARG_NO_NET:
-                        arg_no_net = true;
+                case ARG_PRIVATE_NETWORK:
+                        arg_private_network = true;
                         break;
 
                 case '?':
@@ -710,7 +710,7 @@ int main(int argc, char *argv[]) {
         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
 
-        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) {
+        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) {
                 log_error("clone() failed: %m");
                 goto finish;
         }