minijail: Support writing child pid to file
BUG=chromium:519154
TEST=security_Minijail0 passes
Change-Id: Icedff5d86ef0c3dbf2933e763b0858cb79e5b08f
Reviewed-on: https://chromium-review.googlesource.com/292342
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Nicolas Boichat <drinkcat@chromium.org>
Trybot-Ready: Nicolas Boichat <drinkcat@chromium.org>
Tested-by: Yu-hsi Chiang <yuhsi@google.com>
diff --git a/libminijail.c b/libminijail.c
index b170db0..0a429c9 100644
--- a/libminijail.c
+++ b/libminijail.c
@@ -97,6 +97,7 @@
int chroot:1;
int mount_tmp:1;
int do_init:1;
+ int pid_file:1;
} flags;
uid_t uid;
gid_t gid;
@@ -108,6 +109,7 @@
int filter_len;
int binding_count;
char *chrootdir;
+ char *pid_file_path;
char *uidmap;
char *gidmap;
struct sock_fprog *filter_prog;
@@ -127,6 +129,7 @@
j->flags.readonly = 0;
j->flags.pids = 0;
j->flags.do_init = 0;
+ j->flags.pid_file = 0;
}
/*
@@ -354,6 +357,15 @@
j->flags.mount_tmp = 1;
}
+int API minijail_write_pid_file(struct minijail *j, const char *path)
+{
+ j->pid_file_path = strdup(path);
+ if (!j->pid_file_path)
+ return -ENOMEM;
+ j->flags.pid_file = 1;
+ return 0;
+}
+
int API minijail_bind(struct minijail *j, const char *src, const char *dest,
int writeable)
{
@@ -732,6 +744,18 @@
return 0;
}
+static void write_pid_file(const struct minijail *j)
+{
+ FILE *fp = fopen(j->pid_file_path, "w");
+
+ if (!fp)
+ pdie("failed to open '%s'", j->pid_file_path);
+ if (fprintf(fp, "%d\n", (int)j->initpid) < 0)
+ pdie("fprintf(%s)", j->pid_file_path);
+ if (fclose(fp))
+ pdie("fclose(%s)", j->pid_file_path);
+}
+
void drop_ugid(const struct minijail *j)
{
if (j->flags.usergroups) {
@@ -1264,6 +1288,9 @@
j->initpid = child_pid;
+ if (j->flags.pid_file)
+ write_pid_file(j);
+
if (j->flags.userns)
write_ugid_mappings(j, userns_pipe_fds);
@@ -1411,6 +1438,9 @@
if (child_pid > 0 ) {
j->initpid = child_pid;
+ if (j->flags.pid_file)
+ write_pid_file(j);
+
if (j->flags.userns)
write_ugid_mappings(j, userns_pipe_fds);
diff --git a/libminijail.h b/libminijail.h
index 33fbb16..89abf6a 100644
--- a/libminijail.h
+++ b/libminijail.h
@@ -60,6 +60,7 @@
int minijail_gidmap(struct minijail *j, const char *gidmap);
void minijail_remount_readonly(struct minijail *j);
void minijail_run_as_init(struct minijail *j);
+int minijail_write_pid_file(struct minijail *j, const char *path);
void minijail_inherit_usergroups(struct minijail *j);
void minijail_disable_ptrace(struct minijail *j);
diff --git a/minijail0.c b/minijail0.c
index 3f362f5..921eeb9 100644
--- a/minijail0.c
+++ b/minijail0.c
@@ -76,7 +76,7 @@
{
size_t i;
- printf("Usage: %s [-GhiInprsvtU] [-b <src>,<dest>[,<writeable>]] "
+ printf("Usage: %s [-GhiInprsvtU] [-b <src>,<dest>[,<writeable>]] [-f <file>]"
"[-c <caps>] [-C <dir>] [-g <group>] [-S <file>] [-u <user>] "
"[-m <uid> <loweruid> <count>] [-M <gid> <lowergid> <count>] "
"<program> [args...]\n"
@@ -85,6 +85,7 @@
" -c <caps>: restrict caps to <caps>\n"
" -C <dir>: chroot to <dir>\n"
" -e: enter new network namespace\n"
+ " -f <file>: write the pid of the jailed process to <file>\n"
" -G: inherit secondary groups from uid\n"
" -g <group>: change gid to <group>\n"
" -h: help (this message)\n"
@@ -138,7 +139,7 @@
const char *filter_path;
if (argc > 1 && argv[1][0] != '-')
return 1;
- while ((opt = getopt(argc, argv, "u:g:sS:c:C:b:V:m:M:vrGhHinpLetIU")) != -1) {
+ while ((opt = getopt(argc, argv, "u:g:sS:c:C:b:V:f:m:M:vrGhHinpLetIU")) != -1) {
switch (opt) {
case 'u':
set_user(j, optarg);
@@ -182,6 +183,12 @@
exit(1);
}
break;
+ case 'f':
+ if (0 != minijail_write_pid_file(j, optarg)) {
+ fprintf(stderr, "Could not prepare pid file path.\n");
+ exit(1);
+ }
+ break;
case 't':
minijail_mount_tmp(j);
break;
