internal: move shim and init into app

This structure makes more sense, as both processes are part of an app's lifecycle.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/app/shim/main.go

@@ -0,0 +1,154 @@
+package shim
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"os/signal"
+	"path"
+	"strconv"
+	"syscall"
+
+	"git.gensokyo.uk/security/fortify/fst"
+	"git.gensokyo.uk/security/fortify/helper"
+	"git.gensokyo.uk/security/fortify/helper/proc"
+	"git.gensokyo.uk/security/fortify/helper/seccomp"
+	"git.gensokyo.uk/security/fortify/internal"
+	init0 "git.gensokyo.uk/security/fortify/internal/app/init"
+	"git.gensokyo.uk/security/fortify/internal/fmsg"
+)
+
+// everything beyond this point runs as unconstrained target user
+// proceed with caution!
+
+func Main() {
+	// sharing stdout with fortify
+	// USE WITH CAUTION
+	fmsg.SetPrefix("shim")
+
+	// setting this prevents ptrace
+	if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil {
+		fmsg.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err)
+		panic("unreachable")
+	}
+
+	// receive setup payload
+	var (
+		payload    Payload
+		closeSetup func() error
+	)
+	if f, err := proc.Receive(Env, &payload); err != nil {
+		if errors.Is(err, proc.ErrInvalid) {
+			fmsg.Fatal("invalid config descriptor")
+		}
+		if errors.Is(err, proc.ErrNotSet) {
+			fmsg.Fatal("FORTIFY_SHIM not set")
+		}
+
+		fmsg.Fatalf("cannot decode shim setup payload: %v", err)
+		panic("unreachable")
+	} else {
+		fmsg.SetVerbose(payload.Verbose)
+		closeSetup = f
+	}
+
+	if payload.Bwrap == nil {
+		fmsg.Fatal("bwrap config not supplied")
+	}
+
+	// restore bwrap sync fd
+	var syncFd *os.File
+	if payload.Sync != nil {
+		syncFd = os.NewFile(*payload.Sync, "sync")
+	}
+
+	// close setup socket
+	if err := closeSetup(); err != nil {
+		fmsg.Println("cannot close setup pipe:", err)
+		// not fatal
+	}
+
+	// ensure home directory as target user
+	if s, err := os.Stat(payload.Home); err != nil {
+		if os.IsNotExist(err) {
+			if err = os.Mkdir(payload.Home, 0700); err != nil {
+				fmsg.Fatalf("cannot create home directory: %v", err)
+			}
+		} else {
+			fmsg.Fatalf("cannot access home directory: %v", err)
+		}
+
+		// home directory is created, proceed
+	} else if !s.IsDir() {
+		fmsg.Fatalf("data path %q is not a directory", payload.Home)
+	}
+
+	var ic init0.Payload
+
+	// resolve argv0
+	ic.Argv = payload.Argv
+	if len(ic.Argv) > 0 {
+		// looked up from $PATH by parent
+		ic.Argv0 = payload.Exec[1]
+	} else {
+		// no argv, look up shell instead
+		var ok bool
+		if payload.Bwrap.SetEnv == nil {
+			fmsg.Fatal("no command was specified and environment is unset")
+		}
+		if ic.Argv0, ok = payload.Bwrap.SetEnv["SHELL"]; !ok {
+			fmsg.Fatal("no command was specified and $SHELL was unset")
+		}
+
+		ic.Argv = []string{ic.Argv0}
+	}
+
+	conf := payload.Bwrap
+
+	var extraFiles []*os.File
+
+	// serve setup payload
+	if fd, encoder, err := proc.Setup(&extraFiles); err != nil {
+		fmsg.Fatalf("cannot pipe: %v", err)
+	} else {
+		conf.SetEnv[init0.Env] = strconv.Itoa(fd)
+		go func() {
+			fmsg.VPrintln("transmitting config to init")
+			if err = encoder.Encode(&ic); err != nil {
+				fmsg.Fatalf("cannot transmit init config: %v", err)
+			}
+		}()
+	}
+
+	helper.BubblewrapName = payload.Exec[0] // resolved bwrap path by parent
+	if fmsg.Verbose() {
+		seccomp.CPrintln = fmsg.Println
+	}
+	if b, err := helper.NewBwrap(
+		conf, path.Join(fst.Tmp, "sbin/init"),
+		nil, func(int, int) []string { return make([]string, 0) },
+		extraFiles,
+		syncFd,
+	); err != nil {
+		fmsg.Fatalf("malformed sandbox config: %v", err)
+	} else {
+		b.Stdin(os.Stdin).Stdout(os.Stdout).Stderr(os.Stderr)
+		ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+		defer stop() // unreachable
+
+		// run and pass through exit code
+		if err = b.Start(ctx, false); err != nil {
+			fmsg.Fatalf("cannot start target process: %v", err)
+		} else if err = b.Wait(); err != nil {
+			var exitError *exec.ExitError
+			if !errors.As(err, &exitError) {
+				fmsg.Println("wait:", err)
+				fmsg.Exit(127)
+				panic("unreachable")
+			}
+			fmsg.Exit(exitError.ExitCode())
+			panic("unreachable")
+		}
+	}
+}

internal/app/shim/manager.go

@@ -0,0 +1,139 @@
+package shim
+
+import (
+	"context"
+	"encoding/gob"
+	"errors"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.gensokyo.uk/security/fortify/helper/proc"
+	"git.gensokyo.uk/security/fortify/internal"
+	"git.gensokyo.uk/security/fortify/internal/fmsg"
+)
+
+// used by the parent process
+
+type Shim struct {
+	// user switcher process
+	cmd *exec.Cmd
+	// fallback exit notifier with error returned killing the process
+	killFallback chan error
+	// monitor to shim encoder
+	encoder *gob.Encoder
+	// bwrap --sync-fd value
+	sync *uintptr
+}
+
+func (s *Shim) String() string {
+	if s.cmd == nil {
+		return "(unused shim manager)"
+	}
+	return s.cmd.String()
+}
+
+func (s *Shim) Unwrap() *exec.Cmd {
+	return s.cmd
+}
+
+func (s *Shim) WaitFallback() chan error {
+	return s.killFallback
+}
+
+func (s *Shim) Start(
+	// string representation of application id
+	aid string,
+	// string representation of supplementary group ids
+	supp []string,
+	// bwrap --sync-fd
+	syncFd *os.File,
+) (*time.Time, error) {
+	// prepare user switcher invocation
+	var fsu string
+	if p, ok := internal.Path(internal.Fsu); !ok {
+		fmsg.Fatal("invalid fsu path, this copy of fortify is not compiled correctly")
+		panic("unreachable")
+	} else {
+		fsu = p
+	}
+	s.cmd = exec.Command(fsu)
+
+	// pass shim setup pipe
+	if fd, e, err := proc.Setup(&s.cmd.ExtraFiles); err != nil {
+		return nil, fmsg.WrapErrorSuffix(err,
+			"cannot create shim setup pipe:")
+	} else {
+		s.encoder = e
+		s.cmd.Env = []string{
+			Env + "=" + strconv.Itoa(fd),
+			"FORTIFY_APP_ID=" + aid,
+		}
+	}
+
+	// format fsu supplementary groups
+	if len(supp) > 0 {
+		fmsg.VPrintf("attaching supplementary group ids %s", supp)
+		s.cmd.Env = append(s.cmd.Env, "FORTIFY_GROUPS="+strings.Join(supp, " "))
+	}
+	s.cmd.Stdin, s.cmd.Stdout, s.cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+	s.cmd.Dir = "/"
+
+	// pass sync fd if set
+	if syncFd != nil {
+		fd := proc.ExtraFile(s.cmd, syncFd)
+		s.sync = &fd
+	}
+
+	fmsg.VPrintln("starting shim via fsu:", s.cmd)
+	// withhold messages to stderr
+	fmsg.Suspend()
+	if err := s.cmd.Start(); err != nil {
+		return nil, fmsg.WrapErrorSuffix(err,
+			"cannot start fsu:")
+	}
+	startTime := time.Now().UTC()
+	return &startTime, nil
+}
+
+func (s *Shim) Serve(ctx context.Context, payload *Payload) error {
+	// kill shim if something goes wrong and an error is returned
+	s.killFallback = make(chan error, 1)
+	killShim := func() {
+		if err := s.cmd.Process.Signal(os.Interrupt); err != nil {
+			s.killFallback <- err
+		}
+	}
+	defer func() { killShim() }()
+
+	payload.Sync = s.sync
+	encodeErr := make(chan error)
+	go func() { encodeErr <- s.encoder.Encode(payload) }()
+
+	select {
+	// encode return indicates setup completion
+	case err := <-encodeErr:
+		if err != nil {
+			return fmsg.WrapErrorSuffix(err,
+				"cannot transmit shim config:")
+		}
+		killShim = func() {}
+		return nil
+
+	// setup canceled before payload was accepted
+	case <-ctx.Done():
+		err := ctx.Err()
+		if errors.Is(err, context.Canceled) {
+			return fmsg.WrapError(errors.New("shim setup canceled"),
+				"shim setup canceled")
+		}
+		if errors.Is(err, context.DeadlineExceeded) {
+			return fmsg.WrapError(errors.New("deadline exceeded waiting for shim"),
+				"deadline exceeded waiting for shim")
+		}
+		// unreachable
+		return err
+	}
+}

internal/app/shim/payload.go

@@ -0,0 +1,23 @@
+package shim
+
+import (
+	"git.gensokyo.uk/security/fortify/helper/bwrap"
+)
+
+const Env = "FORTIFY_SHIM"
+
+type Payload struct {
+	// child full argv
+	Argv []string
+	// bwrap, target full exec path
+	Exec [2]string
+	// bwrap config
+	Bwrap *bwrap.Config
+	// path to outer home directory
+	Home string
+	// sync fd
+	Sync *uintptr
+
+	// verbosity pass through
+	Verbose bool
+}