summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--TODO2
-rw-r--r--man/systemd-nspawn.xml2
-rw-r--r--man/systemd.exec.xml26
-rw-r--r--src/dbus-execute.h4
-rw-r--r--src/execute.c15
-rw-r--r--src/execute.h1
-rw-r--r--src/exit-status.c3
-rw-r--r--src/exit-status.h3
-rw-r--r--src/load-fragment-gperf.gperf.m41
-rw-r--r--src/nspawn.c22
10 files changed, 59 insertions, 20 deletions
diff --git a/TODO b/TODO
index eb3f6b8797..7f2d5e6fa5 100644
--- a/TODO
+++ b/TODO
@@ -19,6 +19,8 @@ Bugfixes:
Features:
+* hide PAM/TCPWrap options in fragment parser when compile time disabled
+
* make arbitrary cgroups attributes settable
* when we automatically restart a service, ensure we retsart its rdeps, too.
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 490c6c2cd5..6a0d21f0a5 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -155,7 +155,7 @@
</varlistentry>
<varlistentry>
- <term><option>--no-net</option></term>
+ <term><option>--private-network</option></term>
<listitem><para>Turn off networking in
the container. This makes all network
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 99a91b3dfa..d28417da1c 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -783,9 +783,9 @@
<term><varname>PrivateTmp=</varname></term>
<listitem><para>Takes a boolean
- argument. If true sets up a new
- namespace for the executed processes
- and mounts a private
+ argument. If true sets up a new file
+ system namespace for the executed
+ processes and mounts a private
<filename>/tmp</filename> directory
inside it, that is not shared by
processes outside of the
@@ -794,7 +794,25 @@
process, but makes sharing between
processes via
<filename>/tmp</filename>
- impossible. Defaults to false.</para></listitem>
+ impossible. Defaults to
+ false.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><varname>PrivateNetwork=</varname></term>
+
+ <listitem><para>Takes a boolean
+ argument. If true sets up a new
+ network namespace for the executed
+ processes and configures only the
+ loopback network device
+ <literal>lo</literal> inside it. No
+ other network devices will be
+ available to the executed process.
+ This is useful to securely turn off
+ network access by the executed
+ process. Defaults to
+ false.</para></listitem>
</varlistentry>
<varlistentry>
diff --git a/src/dbus-execute.h b/src/dbus-execute.h
index 49ad6cb82a..2e306794fe 100644
--- a/src/dbus-execute.h
+++ b/src/dbus-execute.h
@@ -92,7 +92,8 @@
" <property name=\"KillMode\" type=\"s\" access=\"read\"/>\n" \
" <property name=\"KillSignal\" type=\"i\" access=\"read\"/>\n" \
" <property name=\"UtmpIdentifier\" type=\"s\" access=\"read\"/>\n" \
- " <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n"
+ " <property name=\"ControlGroupModify\" type=\"b\" access=\"read\"/>\n" \
+ " <property name=\"PrivateNetwork\" type=\"b\" access=\"read\"/>\n"
#define BUS_EXEC_COMMAND_INTERFACE(name) \
" <property name=\"" name "\" type=\"a(sasbttuii)\" access=\"read\"/>\n"
@@ -151,6 +152,7 @@
{ interface, "InaccessibleDirectories", bus_property_append_strv, "as", (context).inaccessible_dirs }, \
{ interface, "MountFlags", bus_property_append_ul, "t", &(context).mount_flags }, \
{ interface, "PrivateTmp", bus_property_append_bool, "b", &(context).private_tmp }, \
+ { interface, "PrivateNetwork", bus_property_append_bool, "b", &(context).private_network }, \
{ interface, "SameProcessGroup", bus_property_append_bool, "b", &(context).same_pgrp }, \
{ interface, "KillMode", bus_execute_append_kill_mode, "s", &(context).kill_mode }, \
{ interface, "KillSignal", bus_property_append_int, "i", &(context).kill_signal }, \
diff --git a/src/execute.c b/src/execute.c
index 668bf9d0f0..c73b0c6c04 100644
--- a/src/execute.c
+++ b/src/execute.c
@@ -56,6 +56,7 @@
#include "missing.h"
#include "utmp-wtmp.h"
#include "def.h"
+#include "loopback-setup.h"
/* This assumes there is a 'tty' group */
#define TTY_MODE 0620
@@ -1208,6 +1209,14 @@ int exec_spawn(ExecCommand *command,
}
}
#endif
+ if (context->private_network) {
+ if (unshare(CLONE_NEWNET) < 0) {
+ r = EXIT_NETWORK;
+ goto fail_child;
+ }
+
+ loopback_setup();
+ }
if (strv_length(context->read_write_dirs) > 0 ||
strv_length(context->read_only_dirs) > 0 ||
@@ -1594,13 +1603,15 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
"%sRootDirectory: %s\n"
"%sNonBlocking: %s\n"
"%sPrivateTmp: %s\n"
- "%sControlGroupModify: %s\n",
+ "%sControlGroupModify: %s\n"
+ "%sPrivateNetwork: %s\n",
prefix, c->umask,
prefix, c->working_directory ? c->working_directory : "/",
prefix, c->root_directory ? c->root_directory : "/",
prefix, yes_no(c->non_blocking),
prefix, yes_no(c->private_tmp),
- prefix, yes_no(c->control_group_modify));
+ prefix, yes_no(c->control_group_modify),
+ prefix, yes_no(c->private_network));
STRV_FOREACH(e, c->environment)
fprintf(f, "%sEnvironment: %s\n", prefix, *e);
diff --git a/src/execute.h b/src/execute.h
index a2d9072357..b376e36a7a 100644
--- a/src/execute.h
+++ b/src/execute.h
@@ -159,6 +159,7 @@ struct ExecContext {
bool cpu_sched_reset_on_fork;
bool non_blocking;
bool private_tmp;
+ bool private_network;
bool control_group_modify;
diff --git a/src/exit-status.c b/src/exit-status.c
index 9b7c027b43..8ed1a0e362 100644
--- a/src/exit-status.c
+++ b/src/exit-status.c
@@ -116,6 +116,9 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) {
case EXIT_PAM:
return "PAM";
+
+ case EXIT_NETWORK:
+ return "NETWORK";
}
}
diff --git a/src/exit-status.h b/src/exit-status.h
index 28f03a5911..3e977b10ef 100644
--- a/src/exit-status.h
+++ b/src/exit-status.h
@@ -64,7 +64,8 @@ typedef enum ExitStatus {
EXIT_CONFIRM,
EXIT_STDERR,
EXIT_TCPWRAP,
- EXIT_PAM
+ EXIT_PAM,
+ EXIT_NETWORK
} ExitStatus;
diff --git a/src/load-fragment-gperf.gperf.m4 b/src/load-fragment-gperf.gperf.m4
index e6d8de72a3..650f44490a 100644
--- a/src/load-fragment-gperf.gperf.m4
+++ b/src/load-fragment-gperf.gperf.m4
@@ -68,6 +68,7 @@ $1.ReadWriteDirectories, config_parse_path_strv, 0,
$1.ReadOnlyDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.read_only_dirs)
$1.InaccessibleDirectories, config_parse_path_strv, 0, offsetof($1, exec_context.inaccessible_dirs)
$1.PrivateTmp, config_parse_bool, 0, offsetof($1, exec_context.private_tmp)
+$1.PrivateNetwork, config_parse_bool, 0, offsetof($1, exec_context.private_network)
$1.MountFlags, config_parse_exec_mount_flags, 0, offsetof($1, exec_context)
$1.TCPWrapName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.tcpwrap_name)
$1.PAMName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.pam_name)
diff --git a/src/nspawn.c b/src/nspawn.c
index c97649d386..2c1144a7f5 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -48,7 +48,7 @@
static char *arg_directory = NULL;
static char *arg_user = NULL;
-static bool arg_no_net = false;
+static bool arg_private_network = false;
static int help(void) {
@@ -57,7 +57,7 @@ static int help(void) {
" -h --help Show this help\n"
" -D --directory=NAME Root directory for the container\n"
" -u --user=USER Run the command under specified user or uid\n"
- " --no-net Disable network in container\n",
+ " --private-network Disable network in container\n",
program_invocation_short_name);
return 0;
@@ -66,15 +66,15 @@ static int help(void) {
static int parse_argv(int argc, char *argv[]) {
enum {
- ARG_NO_NET = 0x100
+ ARG_PRIVATE_NETWORK = 0x100
};
static const struct option options[] = {
- { "help", no_argument, NULL, 'h' },
- { "directory", required_argument, NULL, 'D' },
- { "user", required_argument, NULL, 'u' },
- { "no-net", no_argument, NULL, ARG_NO_NET },
- { NULL, 0, NULL, 0 }
+ { "help", no_argument, NULL, 'h' },
+ { "directory", required_argument, NULL, 'D' },
+ { "user", required_argument, NULL, 'u' },
+ { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
+ { NULL, 0, NULL, 0 }
};
int c;
@@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) {
break;
- case ARG_NO_NET:
- arg_no_net = true;
+ case ARG_PRIVATE_NETWORK:
+ arg_private_network = true;
break;
case '?':
@@ -710,7 +710,7 @@ int main(int argc, char *argv[]) {
sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
- if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) {
+ if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) {
log_error("clone() failed: %m");
goto finish;
}
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-11-17 20:25:30 +0000