On Tue, Aug 06, 2024 at 08:38:37PM +0200, Stefano Brivio wrote:
> If a parent accidentally or due to implementation reasons leaks any
> open file, we don't want to have access to them, except for the file
> passed via --fd, if any.
> 
> This is the case for Podman when Podman's parent leaks files into
> Podman: it's not practical for Podman to close unrelated files before
> starting pasta, as reported by Paul.
> 
> Use close_range(2) to close all open files except for standard streams
> and the one from --fd.
> 
> Given that parts of conf() depend on other files to be already opened,
> such as the epoll file descriptor, we can't easily defer this to a
> more convenient point, where --fd was already parsed. Introduce a
> minimal, duplicate version of --fd parsing to keep this simple.
> 
> Suggested-by: Paul Holzinger <pholzing@redhat.com>
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
> ---
>  conf.c  |  1 +
>  passt.c |  2 ++
>  util.c  | 36 ++++++++++++++++++++++++++++++++++++
>  util.h  |  1 +
>  4 files changed, 40 insertions(+)
> 
> diff --git a/conf.c b/conf.c
> index 14d8ece..89f5b3d 100644
> --- a/conf.c
> +++ b/conf.c
> @@ -1260,6 +1260,7 @@ void conf(struct ctx *c, int argc, char **argv)
>  	c->tcp.fwd_in.mode = c->tcp.fwd_out.mode = FWD_UNSET;
>  	c->udp.fwd_in.mode = c->udp.fwd_out.mode = FWD_UNSET;
>  
> +	optind = 1;
>  	do {
>  		name = getopt_long(argc, argv, optstring, options, NULL);
>  
> diff --git a/passt.c b/passt.c
> index ea5bece..be7e84a 100644
> --- a/passt.c
> +++ b/passt.c
> @@ -211,6 +211,8 @@ int main(int argc, char **argv)
>  
>  	arch_avx2_exec(argv);
>  
> +	close_open_files(argc, argv);

Any reason not to fold this logic into isolate_initial()?  Seems like
it is part of self-isolation handling.

Also, I think this could wait until after the existing
isolate_initial() logic.  Dropping caps before examining the command
line seems like a sensible precaution.

>  	isolate_initial();
>  
>  	c.pasta_netns_fd = c.fd_tap = c.pidfile_fd = -1;
> diff --git a/util.c b/util.c
> index 54a9f58..ca627c6 100644
> --- a/util.c
> +++ b/util.c
> @@ -26,6 +26,7 @@
>  #include <errno.h>
>  #include <stdbool.h>
>  #include <linux/errqueue.h>
> +#include <getopt.h>
>  
>  #include "util.h"
>  #include "iov.h"
> @@ -694,3 +695,38 @@ const char *str_ee_origin(const struct sock_extended_err *ee)
>  
>  	return "<invalid>";
>  }
> +
> +/**
> + * close_open_files() - Close leaked files, but not --fd, stdin, stdout, stderr
> + * @argc:	Argument count
> + * @argv:	Command line options, as we need to skip any file given via --fd
> + */
> +void close_open_files(int argc, char **argv)
> +{
> +	const struct option optfd[] = { { "fd", required_argument, NULL, 'F' },
> +					{ 0 },
> +				      };
> +	long fd = -1;
> +	int name;
> +
> +	do {
> +		name = getopt_long(argc, argv, ":F", optfd, NULL);
> +
> +		if (name == 'F') {
> +			errno = 0;
> +			fd = strtol(optarg, NULL, 0);
> +
> +			if (fd < 0 || errno)
> +				die("Invalid --fd: %s", optarg);
> +		}
> +	} while (name != -1);
> +
> +	if (fd == -1) {
> +		if (close_range(3,	~0U,	CLOSE_RANGE_UNSHARE))

It's weird that close_range() takes unsigneds, although fds are
near-universally signed ints.

> +			die_perror("Failed to close files leaked by parent");
> +	} else {
> +		if (close_range(3,	fd - 1,	CLOSE_RANGE_UNSHARE) ||
> +		    close_range(fd + 1,	~0U,	CLOSE_RANGE_UNSHARE))
> +			die_perror("Failed to close files leaked by parent");
> +	}
> +}
> diff --git a/util.h b/util.h
> index e8bf957..ab11ee7 100644
> --- a/util.h
> +++ b/util.h
> @@ -183,6 +183,7 @@ int __daemon(int pidfile_fd, int devnull_fd);
>  int fls(unsigned long x);
>  int write_file(const char *path, const char *buf);
>  int write_remainder(int fd, const struct iovec *iov, size_t iovcnt, size_t skip);
> +void close_open_files(int argc, char **argv);
>  
>  /**
>   * af_name() - Return name of an address family

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson