exec: introduce PrivateNetwork= process option to turn off network access to specific services

7 files changed, 34 insertions, 15 deletions

diff --git a/src/dbus-execute.h b/src/dbus-execute.h
index 49ad6cb82a..2e306794fe 100644
--- a/src/dbus-execute.h
+++ b/src/dbus-execute.h
@@ -92,7 +92,8 @@
         "  <property name=\"KillMode\" type=\"s\" access=\"read\"/>\n"  \
         "  <property name=\"KillSignal\" type=\"i\" access=\"read\"/>\n" \
         "  <property name=\"UtmpIdentifier\" type=\"s\" access=\"read\"/>\n" \
-        "  <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n"
+        "  <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" \
+        "  <property name=\"PrivateNetwork\" type=\"b\" access=\"read\"/>\n"
 
 #define BUS_EXEC_COMMAND_INTERFACE(name)                             \
         "  <property name=\"" name "\" type=\"a(sasbttuii)\" access=\"read\"/>\n"
@@ -151,6 +152,7 @@
         { interface, "InaccessibleDirectories",       bus_property_append_strv,   "as",    (context).inaccessible_dirs             }, \
         { interface, "MountFlags",                    bus_property_append_ul,     "t",     &(context).mount_flags                  }, \
         { interface, "PrivateTmp",                    bus_property_append_bool,   "b",     &(context).private_tmp                  }, \
+        { interface, "PrivateNetwork",                bus_property_append_bool,   "b",     &(context).private_network              }, \
         { interface, "SameProcessGroup",              bus_property_append_bool,   "b",     &(context).same_pgrp                    }, \
         { interface, "KillMode",                      bus_execute_append_kill_mode, "s",   &(context).kill_mode                    }, \
         { interface, "KillSignal",                    bus_property_append_int,    "i",     &(context).kill_signal                  }, \
diff --git a/src/execute.c b/src/execute.c
index 668bf9d0f0..c73b0c6c04 100644
--- a/src/execute.c
+++ b/src/execute.c
@@ -56,6 +56,7 @@
 #include "missing.h"
 #include "utmp-wtmp.h"
 #include "def.h"
+#include "loopback-setup.h"
 
 /* This assumes there is a 'tty' group */
 #define TTY_MODE 0620
@@ -1208,6 +1209,14 @@ int exec_spawn(ExecCommand *command,
                         }
                 }
 #endif
+                if (context->private_network) {
+                        if (unshare(CLONE_NEWNET) < 0) {
+                                r = EXIT_NETWORK;
+                                goto fail_child;
+                        }
+
+                        loopback_setup();
+                }
 
                 if (strv_length(context->read_write_dirs) > 0 ||
                     strv_length(context->read_only_dirs) > 0 ||
@@ -1594,13 +1603,15 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
                 "%sRootDirectory: %s\n"
                 "%sNonBlocking: %s\n"
                 "%sPrivateTmp: %s\n"
-                "%sControlGroupModify: %s\n",
+                "%sControlGroupModify: %s\n"
+                "%sPrivateNetwork: %s\n",
                 prefix, c->umask,
                 prefix, c->working_directory ? c->working_directory : "/",
                 prefix, c->root_directory ? c->root_directory : "/",
                 prefix, yes_no(c->non_blocking),
                 prefix, yes_no(c->private_tmp),
-                prefix, yes_no(c->control_group_modify));
+                prefix, yes_no(c->control_group_modify),
+                prefix, yes_no(c->private_network));
 
         STRV_FOREACH(e, c->environment)
                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
diff --git a/src/execute.h b/src/execute.h
index a2d9072357..b376e36a7a 100644
--- a/src/execute.h
+++ b/src/execute.h
@@ -159,6 +159,7 @@ struct ExecContext {
         bool cpu_sched_reset_on_fork;
         bool non_blocking;
         bool private_tmp;
+        bool private_network;
 
         bool control_group_modify;
 
diff --git a/src/exit-status.c b/src/exit-status.c
index 9b7c027b43..8ed1a0e362 100644
--- a/src/exit-status.c
+++ b/src/exit-status.c
@@ -116,6 +116,9 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) {
 
                 case EXIT_PAM:
                         return "PAM";
+
+                case EXIT_NETWORK:
+                        return "NETWORK";
                 }
         }
 
diff --git a/src/exit-status.h b/src/exit-status.h
index 28f03a5911..3e977b10ef 100644
--- a/src/exit-status.h
+++ b/src/exit-status.h
@@ -64,7 +64,8 @@ typedef enum ExitStatus {
         EXIT_CONFIRM,
         EXIT_STDERR,
         EXIT_TCPWRAP,
-        EXIT_PAM
+        EXIT_PAM,
+        EXIT_NETWORK
 
 } ExitStatus;
 
diff --git a/src/load-fragment-gperf.gperf.m4 b/src/load-fragment-gperf.gperf.m4
index e6d8de72a3..650f44490a 100644
--- a/src/load-fragment-gperf.gperf.m4
+++ b/src/load-fragment-gperf.gperf.m4
@@ -68,6 +68,7 @@ $1.ReadWriteDirectories,         config_parse_path_strv,             0,
 $1.ReadOnlyDirectories,          config_parse_path_strv,             0,                             offsetof($1, exec_context.read_only_dirs)
 $1.InaccessibleDirectories,      config_parse_path_strv,             0,                             offsetof($1, exec_context.inaccessible_dirs)
 $1.PrivateTmp,                   config_parse_bool,                  0,                             offsetof($1, exec_context.private_tmp)
+$1.PrivateNetwork,               config_parse_bool,                  0,                             offsetof($1, exec_context.private_network)
 $1.MountFlags,                   config_parse_exec_mount_flags,      0,                             offsetof($1, exec_context)
 $1.TCPWrapName,                  config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.tcpwrap_name)
 $1.PAMName,                      config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.pam_name)
diff --git a/src/nspawn.c b/src/nspawn.c
index c97649d386..2c1144a7f5 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -48,7 +48,7 @@
 
 static char *arg_directory = NULL;
 static char *arg_user = NULL;
-static bool arg_no_net = false;
+static bool arg_private_network = false;
 
 static int help(void) {
 
@@ -57,7 +57,7 @@ static int help(void) {
                "  -h --help            Show this help\n"
                "  -D --directory=NAME  Root directory for the container\n"
                "  -u --user=USER       Run the command under specified user or uid\n"
-               "     --no-net          Disable network  in container\n",
+               "     --private-network Disable network in container\n",
                program_invocation_short_name);
 
         return 0;
@@ -66,15 +66,15 @@ static int help(void) {
 static int parse_argv(int argc, char *argv[]) {
 
         enum {
-                ARG_NO_NET = 0x100
+                ARG_PRIVATE_NETWORK = 0x100
         };
 
         static const struct option options[] = {
-                { "help",      no_argument,       NULL, 'h'        },
-                { "directory", required_argument, NULL, 'D'        },
-                { "user",      required_argument, NULL, 'u'        },
-                { "no-net",    no_argument,       NULL, ARG_NO_NET },
-                { NULL,        0,                 NULL, 0          }
+                { "help",            no_argument,       NULL, 'h'                 },
+                { "directory",       required_argument, NULL, 'D'                 },
+                { "user",            required_argument, NULL, 'u'                 },
+                { "private-network", no_argument,       NULL, ARG_PRIVATE_NETWORK },
+                { NULL,              0,                 NULL, 0                   }
         };
 
         int c;
@@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) {
 
                         break;
 
-                case ARG_NO_NET:
-                        arg_no_net = true;
+                case ARG_PRIVATE_NETWORK:
+                        arg_private_network = true;
                         break;
 
                 case '?':
@@ -710,7 +710,7 @@ int main(int argc, char *argv[]) {
         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
 
-        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) {
+        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) {
                 log_error("clone() failed: %m");
                 goto finish;
         }