From 5c4aa63bf1a147ac47ae41c1fdbfe05c77cf7e5b Mon Sep 17 00:00:00 2001 From: "Jason T. Greene" Date: Thu, 17 Aug 2023 03:09:45 -0500 Subject: [PATCH 1/3] Fix git://git.qemu.org urls which no longer respond Signed-off-by: Jason T. Greene --- Dockerfile.buildtests | 6 +++--- Dockerfile.tests | 2 +- Vagrantfile | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile.buildtests b/Dockerfile.buildtests index f018b03..620ddaa 100644 --- a/Dockerfile.buildtests +++ b/Dockerfile.buildtests @@ -3,7 +3,7 @@ ARG LIBSLIRP_COMMIT=v4.7.0 # Alpine FROM alpine:3 AS buildtest-alpine3-static RUN apk add --no-cache git build-base autoconf automake libtool linux-headers glib-dev glib-static libcap-static libcap-dev libseccomp-dev libseccomp-static git meson -RUN git clone git://git.qemu.org/libslirp.git /libslirp +RUN git clone https://git.qemu.org/libslirp.git /libslirp WORKDIR /libslirp ARG LIBSLIRP_COMMIT RUN git pull && git checkout ${LIBSLIRP_COMMIT} && meson setup --default-library=both build && ninja -C build install @@ -16,7 +16,7 @@ FROM ubuntu:18.04 AS buildtest-ubuntu1804-common ENV DEBIAN_FRONTEND=noninteractive RUN apt update && apt install -y automake autotools-dev make gcc libglib2.0-dev libcap-dev libseccomp-dev git ninja-build python3-pip RUN pip3 install meson -RUN git clone git://git.qemu.org/libslirp.git /libslirp +RUN git clone https://git.qemu.org/libslirp.git /libslirp WORKDIR /libslirp ARG LIBSLIRP_COMMIT RUN git pull && git checkout ${LIBSLIRP_COMMIT} && meson setup build && ninja -C build install @@ -34,7 +34,7 @@ RUN ./configure && make && cp -f slirp4netns / FROM opensuse/leap:15 AS buildtest-opensuse15-common RUN zypper install -y --no-recommends autoconf automake gcc glib2-devel git make libcap-devel libseccomp-devel ninja python3-pip RUN pip3 install meson -RUN git clone git://git.qemu.org/libslirp.git /libslirp +RUN git clone https://git.qemu.org/libslirp.git /libslirp WORKDIR /libslirp ARG LIBSLIRP_COMMIT RUN git pull && git checkout ${LIBSLIRP_COMMIT} && meson setup --default-library=both build && ninja -C build install diff --git a/Dockerfile.tests b/Dockerfile.tests index 18d6ca4..e12d3b9 100644 --- a/Dockerfile.tests +++ b/Dockerfile.tests @@ -4,7 +4,7 @@ FROM ubuntu:22.04 AS build ENV DEBIAN_FRONTEND=noninteractive RUN apt update && apt install -y automake autotools-dev make gcc libglib2.0-dev libcap-dev libseccomp-dev git ninja-build python3-pip RUN pip3 install meson -RUN git clone git://git.qemu.org/libslirp.git /libslirp +RUN git clone https://git.qemu.org/libslirp.git /libslirp WORKDIR /libslirp ARG LIBSLIRP_COMMIT RUN git pull && git checkout ${LIBSLIRP_COMMIT} && meson setup build && ninja -C build install diff --git a/Vagrantfile b/Vagrantfile index 9a1bb52..dd88bee 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -34,7 +34,7 @@ Vagrant.configure("2") do |config| git clone --depth=1 --no-checkout https://github.com/seccomp/libseccomp git -C ./libseccomp fetch --tags --depth=1 - git clone --depth=1 --no-checkout git://git.qemu.org/libslirp.git + git clone --depth=1 --no-checkout https://git.qemu.org/libslirp.git git -C ./libslirp fetch --tags --depth=1 touch ./build-and-test From 7b798d6481b8051a86b7a94ce8d203477cf2b3df Mon Sep 17 00:00:00 2001 From: "Jason T. Greene" Date: Thu, 17 Aug 2023 04:09:41 -0500 Subject: [PATCH 2/3] Update buildx actions Signed-off-by: Jason T. Greene --- .github/workflows/release.yaml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 36429a4..63978e7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -5,21 +5,22 @@ on: jobs: release: - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v3 - - uses: docker/setup-buildx-action@v1 + - uses: docker/setup-qemu-action@v2 + - uses: docker/setup-buildx-action@v2 - name: "Build binaries from Dockerfile.artifact" - run: docker buildx build -o /tmp --platform=amd64,arm64,arm,s390x,ppc64le,riscv64 -f Dockerfile.artifact . + run: docker buildx build -o /tmp/slirpbuilds --platform=amd64,arm64,arm,s390x,ppc64le,riscv64 -f Dockerfile.artifact . - name: "Create /tmp/artifact" run: | mkdir -p /tmp/artifact - mv /tmp/linux_amd64/slirp4netns /tmp/artifact/slirp4netns-x86_64 - mv /tmp/linux_arm64/slirp4netns /tmp/artifact/slirp4netns-aarch64 - mv /tmp/linux_arm_v7/slirp4netns /tmp/artifact/slirp4netns-armv7l - mv /tmp/linux_s390x/slirp4netns /tmp/artifact/slirp4netns-s390x - mv /tmp/linux_ppc64le/slirp4netns /tmp/artifact/slirp4netns-ppc64le - mv /tmp/linux_riscv64/slirp4netns /tmp/artifact/slirp4netns-riscv64 + mv /tmp/slirpbuilds/linux_amd64/slirp4netns /tmp/artifact/slirp4netns-x86_64 + mv /tmp/slirpbuilds/linux_arm64/slirp4netns /tmp/artifact/slirp4netns-aarch64 + mv /tmp/slirpbuilds/linux_arm_v7/slirp4netns /tmp/artifact/slirp4netns-armv7l + mv /tmp/slirpbuilds/linux_s390x/slirp4netns /tmp/artifact/slirp4netns-s390x + mv /tmp/slirpbuilds/linux_ppc64le/slirp4netns /tmp/artifact/slirp4netns-ppc64le + mv /tmp/slirpbuilds/linux_riscv64/slirp4netns /tmp/artifact/slirp4netns-riscv64 - name: "SHA256SUMS" run: (cd /tmp/artifact; sha256sum *) | tee /tmp/SHA256SUMS - name: "The sha256sum of the SHA256SUMS file" From 9103678a1bedf2db33bc3748302a547fcd577140 Mon Sep 17 00:00:00 2001 From: "Jason T. Greene" Date: Thu, 17 Aug 2023 02:23:27 -0500 Subject: [PATCH 3/3] Add support for escaping resolv.conf symlinks Previously if resolv.conf was symlinked to a location other than /etc, or /run, a warning message would be printed and DNS would be non-functional. Instead, attempt to bind an equiavlent resolv.conf link target path in the namespace structure, so that symlink continues to function, and DNS remains operational. Signed-off-by: Jason T. Greene --- sandbox.c | 66 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 52 insertions(+), 14 deletions(-) diff --git a/sandbox.c b/sandbox.c index 13514cb..f0ab48e 100644 --- a/sandbox.c +++ b/sandbox.c @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-or-later */ #define _GNU_SOURCE #include +#include #include #include #include @@ -27,7 +28,8 @@ static int add_mount(const char *from, const char *to) MS_BIND | MS_REC | MS_SLAVE | MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL); if (ret < 0) { - fprintf(stderr, "cannot bind mount %s to %s\n", from, to); + fprintf(stderr, "cannot bind mount %s to %s (errno: %d)\n", from, to, + errno); return ret; } ret = mount("", to, "", MS_SLAVE | MS_REC, NULL); @@ -46,21 +48,54 @@ static int add_mount(const char *from, const char *to) return 0; } -/* Warn (not error) if /etc/resolv.conf is a symlink to a file outside /etc or +/* Bind /etc/resolv.conf if it is a symlink to a file outside /etc or * /run. */ -static void validate_etc_resolv_conf() +static int bind_escaped_resolv_conf(const char *root) { - char *p = realpath("/etc/resolv.conf", NULL); - if (p == NULL) { - return; + char *real_resolv = realpath("/etc/resolv.conf", NULL); + + /* Doesn't exist or is not an escaping symlink */ + if (real_resolv == NULL || g_str_has_prefix(real_resolv, "/etc") || + g_str_has_prefix(real_resolv, "/run")) { + free(real_resolv); + return 0; + } + + char *resolv_dest = g_strconcat(root, real_resolv, NULL); + char *resolv_dest_dir = g_path_get_dirname(resolv_dest); + int ret = 0; + + fprintf(stderr, + "sandbox: /etc/resolv.conf (-> %s) seems a symlink to a file " + "outside {/etc, /run}, attempting to bind it as well.\n", + real_resolv); + + ret = g_mkdir_with_parents(resolv_dest_dir, 0755); + if (ret < 0) { + fprintf(stderr, "cannot create resolve dest dir path: %s\n", + resolv_dest_dir); + goto finish; + } + + ret = creat(resolv_dest, 0644); + if (ret < 0) { + fprintf(stderr, "cannot create empty resolv.conf dest file %s\n", + resolv_dest); + goto finish; } - if (!g_str_has_prefix(p, "/etc") && !g_str_has_prefix(p, "/run")) { - fprintf(stderr, - "sandbox: /etc/resolv.conf (-> %s) seems a symlink to a file " - "outside {/etc, /run}. DNS will not work.\n", - p); + close(ret); + + ret = add_mount(real_resolv, resolv_dest); + if (ret < 0) { + fprintf(stderr, "cannot bind mount resolv.conf\n"); } - free(p); + +finish: + + free(real_resolv); + g_free(resolv_dest); + g_free(resolv_dest_dir); + return ret; } /* lock down the process doing the following: @@ -75,8 +110,6 @@ int create_sandbox() struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 }; struct __user_cap_data_struct data[2] = { { 0 } }; - validate_etc_resolv_conf(); - ret = unshare(CLONE_NEWNS); if (ret < 0) { fprintf(stderr, "cannot unshare new mount namespace\n"); @@ -118,6 +151,11 @@ int create_sandbox() return ret; } + ret = bind_escaped_resolv_conf("/tmp"); + if (ret < 0) { + return ret; + } + ret = add_mount("/run", "/tmp/run"); if (ret < 0) { return ret;