132 lines
4.3 KiB
Diff
132 lines
4.3 KiB
Diff
diff --git a/modules/pam_namespace/namespace.conf.5.xml b/modules/pam_namespace/namespace.conf.5.xml
|
|
index c7698cb..a94b49e 100644
|
|
--- a/modules/pam_namespace/namespace.conf.5.xml
|
|
+++ b/modules/pam_namespace/namespace.conf.5.xml
|
|
@@ -122,9 +122,14 @@
|
|
<para><emphasis>mntopts</emphasis>=<replaceable>value</replaceable>
|
|
- value of this flag is passed to the mount call when the tmpfs mount is
|
|
done. It allows for example the specification of the maximum size of the
|
|
- tmpfs instance that is created by the mount call. See <citerefentry>
|
|
- <refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum>
|
|
- </citerefentry> for details.
|
|
+ tmpfs instance that is created by the mount call. In addition to
|
|
+ options specified in the <citerefentry>
|
|
+ <refentrytitle>tmpfs</refentrytitle><manvolnum>5</manvolnum>
|
|
+ </citerefentry> manual the <emphasis>nosuid</emphasis>,
|
|
+ <emphasis>noexec</emphasis>, and <emphasis>nodev</emphasis> flags
|
|
+ can be used to respectively disable setuid bit effect, disable running
|
|
+ executables, and disable devices to be interpreted on the mounted
|
|
+ tmpfs filesystem.
|
|
</para>
|
|
|
|
<para>
|
|
diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
|
|
index f541f89..660c7a1 100644
|
|
--- a/modules/pam_namespace/pam_namespace.c
|
|
+++ b/modules/pam_namespace/pam_namespace.c
|
|
@@ -230,6 +230,73 @@ static int parse_iscript_params(char *params, struct polydir_s *poly)
|
|
return 0;
|
|
}
|
|
|
|
+struct mntflag {
|
|
+ const char *name;
|
|
+ size_t len;
|
|
+ unsigned long flag;
|
|
+};
|
|
+
|
|
+#define LITERAL_AND_LEN(x) x, sizeof(x) - 1
|
|
+
|
|
+static const struct mntflag mntflags[] = {
|
|
+ { LITERAL_AND_LEN("noexec"), MS_NOEXEC },
|
|
+ { LITERAL_AND_LEN("nosuid"), MS_NOSUID },
|
|
+ { LITERAL_AND_LEN("nodev"), MS_NODEV }
|
|
+ };
|
|
+
|
|
+static int filter_mntopts(const char *opts, char **filtered,
|
|
+ unsigned long *mountflags)
|
|
+{
|
|
+ size_t origlen = strlen(opts);
|
|
+ const char *end;
|
|
+ char *dest;
|
|
+
|
|
+ dest = *filtered = NULL;
|
|
+ *mountflags = 0;
|
|
+
|
|
+ if (origlen == 0)
|
|
+ return 0;
|
|
+
|
|
+ do {
|
|
+ size_t len;
|
|
+ int i;
|
|
+
|
|
+ end = strchr(opts, ',');
|
|
+ if (end == NULL) {
|
|
+ len = strlen(opts);
|
|
+ } else {
|
|
+ len = end - opts;
|
|
+ }
|
|
+
|
|
+ for (i = 0; i < (int)(sizeof(mntflags)/sizeof(mntflags[0])); i++) {
|
|
+ if (mntflags[i].len != len)
|
|
+ continue;
|
|
+ if (memcmp(mntflags[i].name, opts, len) == 0) {
|
|
+ *mountflags |= mntflags[i].flag;
|
|
+ opts = end;
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (opts != end) {
|
|
+ if (dest != NULL) {
|
|
+ *dest = ',';
|
|
+ ++dest;
|
|
+ } else {
|
|
+ dest = *filtered = calloc(1, origlen + 1);
|
|
+ if (dest == NULL)
|
|
+ return -1;
|
|
+ }
|
|
+ memcpy(dest, opts, len);
|
|
+ dest += len;
|
|
+ }
|
|
+
|
|
+ opts = end + 1;
|
|
+ } while (end != NULL);
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
static int parse_method(char *method, struct polydir_s *poly,
|
|
struct instance_data *idata)
|
|
{
|
|
@@ -289,7 +356,8 @@ static int parse_method(char *method, struct polydir_s *poly,
|
|
break;
|
|
}
|
|
free(poly->mount_opts); /* if duplicate mntopts specified */
|
|
- if ((poly->mount_opts = strdup(flag+namelen+1)) == NULL) {
|
|
+ poly->mount_opts = NULL;
|
|
+ if (filter_mntopts(flag+namelen+1, &poly->mount_opts, &poly->mount_flags) != 0) {
|
|
pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error");
|
|
return -1;
|
|
}
|
|
@@ -1484,7 +1552,7 @@ static int ns_setup(struct polydir_s *polyptr,
|
|
}
|
|
|
|
if (polyptr->method == TMPFS) {
|
|
- if (mount("tmpfs", polyptr->dir, "tmpfs", 0, polyptr->mount_opts) < 0) {
|
|
+ if (mount("tmpfs", polyptr->dir, "tmpfs", polyptr->mount_flags, polyptr->mount_opts) < 0) {
|
|
pam_syslog(idata->pamh, LOG_ERR, "Error mounting tmpfs on %s, %m",
|
|
polyptr->dir);
|
|
return PAM_SESSION_ERR;
|
|
diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_namespace.h
|
|
index 47ebcc3..1522386 100644
|
|
--- a/modules/pam_namespace/pam_namespace.h
|
|
+++ b/modules/pam_namespace/pam_namespace.h
|
|
@@ -166,6 +166,7 @@ struct polydir_s {
|
|
unsigned int flags; /* polydir flags */
|
|
char *init_script; /* path to init script */
|
|
char *mount_opts; /* mount options for tmpfs mount */
|
|
+ unsigned long mount_flags; /* mount flags for tmpfs mount */
|
|
uid_t owner; /* user which should own the polydir */
|
|
gid_t group; /* group which should own the polydir */
|
|
mode_t mode; /* mode of the polydir */
|