|
| 1 | +#!/bin/bash |
| 2 | +# Add bind mounts in a user namespace and change to that space. |
| 3 | +# Requires being able to run unshare -rm and the ability to do fuse mounts |
| 4 | +# (kernel >= 4.18) and requires fuse-overlayfs. |
| 5 | +# Written by Dave Dykstra November 2024, based heavily on cvmfsexec. |
| 6 | + |
| 7 | +#set -x |
| 8 | +#PS4='c$$+ ' |
| 9 | + |
| 10 | +VERSION=4.42 |
| 11 | + |
| 12 | +usage() |
| 13 | +{ |
| 14 | + echo "Usage: bindexec [-v] [src:dest ...] -- [command]" >&2 |
| 15 | + echo " Bind mount each src to dest in new user mount namespace" >&2 |
| 16 | + echo " -v: print current version and exit" >&2 |
| 17 | + exit 1 |
| 18 | +} |
| 19 | + |
| 20 | +# needed for pivot_root |
| 21 | +PATH=$PATH:/usr/sbin |
| 22 | + |
| 23 | +TMPD="$(mktemp -d /dev/shm/bindexec.XXXXXXXXXX)" |
| 24 | +trap "rm -rf $TMPD" 0 # note that trap does not carry past exec |
| 25 | +STARTFIFO=$TMPD/start |
| 26 | +WAITFIFO=$TMPD/wait |
| 27 | +mkfifo $STARTFIFO $WAITFIFO |
| 28 | + |
| 29 | +# bash syntax {NAME}<&N doesn't work on older bashes such as the |
| 30 | +# version 3.2.x on macOS Big Sur, and in fact it fails with an error |
| 31 | +# message but not an error code, so test for it first to be able to |
| 32 | +# gracefully die |
| 33 | + |
| 34 | +if [ -n "$({TESTX}<&0 2>&1)" ]; then |
| 35 | + echo "Cannot assign file descriptors to variables, bash version too old" >&2 |
| 36 | + exit 1 |
| 37 | +fi |
| 38 | + |
| 39 | +# make a copy of stdin fd, for sending to the final command |
| 40 | +exec {STDINCOPYFD}<&0 |
| 41 | + |
| 42 | +ORIGPWD=$PWD |
| 43 | + |
| 44 | +# can't use OPTIND because it can't distinguish between -- there or missing |
| 45 | +NOPTS=0 |
| 46 | +while getopts "v" OPTION; do |
| 47 | + let NOPTS+=1 |
| 48 | + case $OPTION in |
| 49 | + v) echo "$VERSION" |
| 50 | + exit |
| 51 | + ;; |
| 52 | + \?) usage |
| 53 | + ;; |
| 54 | + esac |
| 55 | +done |
| 56 | +shift $NOPTS |
| 57 | + |
| 58 | +BINDS="" |
| 59 | +for ARG; do |
| 60 | + if [ "$ARG" == "--" ]; then |
| 61 | + break |
| 62 | + fi |
| 63 | + if [[ "$ARG" != *:* ]]; then |
| 64 | + usage |
| 65 | + fi |
| 66 | + BINDS="$BINDS $ARG" |
| 67 | + shift |
| 68 | +done |
| 69 | + |
| 70 | +if [ "$ARG" != "--" ]; then |
| 71 | + usage |
| 72 | +fi |
| 73 | +shift |
| 74 | + |
| 75 | +ORIGUID="$(id -u)" |
| 76 | +ORIGGID="$(id -g)" |
| 77 | + |
| 78 | +# Note that within the HERE document, unprotected $ substitutions are |
| 79 | +# done by the surrounding shell, and \$ is within the unshare shell |
| 80 | +unshare -rm -pf /bin/bash /dev/stdin "${@:-$SHELL}" <<!EOF-1! |
| 81 | + #set -x |
| 82 | + #PS4='c\$$+ ' |
| 83 | +
|
| 84 | + # now in the first "fake root" namespace |
| 85 | + mount -t proc proc /proc |
| 86 | + mkdir -p $TMPD/upper $TMPD/work $TMPD/overlay |
| 87 | +
|
| 88 | + # put the bind mounts into the upper dir |
| 89 | + for BIND in $BINDS; do |
| 90 | + SRC="\${BIND%:*}" |
| 91 | + DST="\${BIND#*:}" |
| 92 | + if [ -d "\$SRC" ]; then |
| 93 | + mkdir -p $TMPD/upper/\$DST |
| 94 | + elif [ -f "\$SRC" ]; then |
| 95 | + DSTDIR="\${DST%/*}" |
| 96 | + if [ "\$DST" != "\$DSTDIR" ]; then |
| 97 | + mkdir -p $TMPD/upper/\$DSTDIR |
| 98 | + fi |
| 99 | + touch $TMPD/upper/\$DST |
| 100 | + else |
| 101 | + echo "bindexec: \$SRC not found, skipping" >&2 |
| 102 | + fi |
| 103 | + mount --bind \$SRC $TMPD/upper/\$DST |
| 104 | + done |
| 105 | +
|
| 106 | + # Leave this bash running as PID 1, because most other |
| 107 | + # programs won't handle signals & child reaping correctly. |
| 108 | + # Note that all other processes in the namespaces will get |
| 109 | + # a SIGKILL when PID 1 exits. |
| 110 | + trap "" 1 2 3 15 # ignore all ordinary signals |
| 111 | +
|
| 112 | + fuse-overlayfs -o lowerdir=/,upperdir=$TMPD/upper,workdir=$TMPD/work $TMPD/overlay 2> >(grep -v lazytime >&2) |
| 113 | + # put original system dirs on top of the overlay |
| 114 | + mount -t proc proc $TMPD/overlay/proc |
| 115 | + mount --rbind /sys $TMPD/overlay/sys |
| 116 | + mount --rbind /dev $TMPD/overlay/dev |
| 117 | + mount --rbind /run $TMPD/overlay/run |
| 118 | +
|
| 119 | + # also overlay nfs mounts because they don't work through overlay |
| 120 | + mount|while read FROM X TO X TYPE REST; do |
| 121 | + if [[ \$TYPE = nfs* ]]; then |
| 122 | + mkdir -p $TMPD/overlay/\$TO |
| 123 | + mount --bind \$TO $TMPD/overlay/\$TO |
| 124 | + fi |
| 125 | + done |
| 126 | +
|
| 127 | + # Start a second fake root namespace so we don't interfere with the |
| 128 | + # fuse-overlayfs mount space when we do the pivot_root. |
| 129 | + # Quoting the HERE document's delimeter makes this nested shell not |
| 130 | + # interpret $ substitutions, but the previous one still does so |
| 131 | + # need to use \$ when don't want first shell to expand. |
| 132 | + unshare -rm /bin/bash /dev/stdin "\${@:-$SHELL}" <<'!EOF-2!' |
| 133 | + #set -x |
| 134 | + #PS4='c\$$+ ' |
| 135 | +
|
| 136 | + ( |
| 137 | + # This is a background process for setting up the child's uid map |
| 138 | + trap "" 1 2 3 15 # ignore ordinary signals |
| 139 | + read PID |
| 140 | + # set up uid/gid map |
| 141 | + echo "$ORIGGID 0 1" >/proc/"\$PID"/gid_map |
| 142 | + echo "$ORIGUID 0 1" >/proc/"\$PID"/uid_map |
| 143 | + echo "ready" >$WAITFIFO |
| 144 | + ) <$STARTFIFO & |
| 145 | + |
| 146 | + # Change to the new root. Would use chroot but it doesn't work. |
| 147 | + mount --rbind $TMPD/overlay $TMPD/overlay # pivot_root requires this |
| 148 | + cd $TMPD/overlay |
| 149 | + mkdir -p .old-root |
| 150 | + pivot_root . .old-root |
| 151 | + cd $ORIGPWD |
| 152 | +
|
| 153 | + # Finally, start the user namespace with the original uid/gid |
| 154 | + # This HERE document is also quoted and so the shell does not expand |
| 155 | + exec unshare -U /bin/bash /dev/stdin "\${@:-$SHELL}" <<'!EOF-3!' |
| 156 | + #set -x |
| 157 | + #PS4='c\$$+ ' |
| 158 | +
|
| 159 | + # now in the user namespace |
| 160 | +
|
| 161 | + echo "\$$" >$STARTFIFO |
| 162 | + # wait for the uid/gid maps to be set up |
| 163 | + read X <$WAITFIFO |
| 164 | +
|
| 165 | + exec "\$@" <&$STDINCOPYFD $STDINCOPYFD<&- |
| 166 | +!EOF-3! |
| 167 | +
|
| 168 | +!EOF-2! |
| 169 | +
|
| 170 | +!EOF-1! |
0 commit comments