1 /* chroot -- run command or shell with special root directory
2 Copyright (C) 1995-2023 Free Software Foundation, Inc.
4 This program is free software: you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation, either version 3 of the License, or
7 (at your option) any later version.
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
14 You should have received a copy of the GNU General Public License
15 along with this program. If not, see <https://www.gnu.org/licenses/>. */
17 /* Written by Roland McGrath. */
22 #include <sys/types.h>
27 #include "ignore-value.h"
28 #include "mgetgroups.h"
30 #include "root-dev-ino.h"
34 /* The official name of this program (e.g., no 'g' prefix). */
35 #define PROGRAM_NAME "chroot"
37 #define AUTHORS proper_name ("Roland McGrath")
40 # define MAXGID GID_T_MAX
43 static inline bool uid_unset (uid_t uid
) { return uid
== (uid_t
) -1; }
44 static inline bool gid_unset (gid_t gid
) { return gid
== (gid_t
) -1; }
45 #define uid_set(x) (!uid_unset (x))
46 #define gid_set(x) (!gid_unset (x))
50 GROUPS
= UCHAR_MAX
+ 1,
55 static struct option
const long_opts
[] =
57 {"groups", required_argument
, nullptr, GROUPS
},
58 {"userspec", required_argument
, nullptr, USERSPEC
},
59 {"skip-chdir", no_argument
, nullptr, SKIP_CHDIR
},
60 {GETOPT_HELP_OPTION_DECL
},
61 {GETOPT_VERSION_OPTION_DECL
},
62 {nullptr, 0, nullptr, 0}
66 /* At least Interix lacks supplemental group support. */
68 setgroups (size_t size
, MAYBE_UNUSED gid_t
const *list
)
72 /* Return success when clearing supplemental groups
73 as ! HAVE_SETGROUPS should only be the case on
74 platforms that don't support supplemental groups. */
85 /* Determine the group IDs for the specified supplementary GROUPS,
86 which is a comma separated list of supplementary groups (names or numbers).
87 Allocate an array for the parsed IDs and store it in PGIDS,
88 which may be allocated even on parse failure.
89 Update the number of parsed groups in PN_GIDS on success.
90 Upon any failure return nonzero, and issue diagnostic if SHOW_ERRORS is true.
91 Otherwise return zero. */
94 parse_additional_groups (char const *groups
, GETGROUPS_T
**pgids
,
95 size_t *pn_gids
, bool show_errors
)
97 GETGROUPS_T
*gids
= nullptr;
98 size_t n_gids_allocated
= 0;
100 char *buffer
= xstrdup (groups
);
104 for (tmp
= strtok (buffer
, ","); tmp
; tmp
= strtok (nullptr, ","))
109 if (xstrtoumax (tmp
, nullptr, 10, &value
, "") == LONGINT_OK
112 while (isspace (to_uchar (*tmp
)))
116 /* Handle the case where the name is numeric. */
121 /* Flag that we've got a group from the number. */
122 g
= (struct group
*) (intptr_t) ! nullptr;
137 error (0, errno
, _("invalid group %s"), quote (tmp
));
144 if (n_gids
== n_gids_allocated
)
145 gids
= X2NREALLOC (gids
, &n_gids_allocated
);
146 gids
[n_gids
++] = value
;
149 if (ret
== 0 && n_gids
== 0)
152 error (0, 0, _("invalid group list %s"), quote (groups
));
165 /* Return whether the passed path is equivalent to "/".
166 Note we don't compare against get_root_dev_ino() as "/"
167 could be bind mounted to a separate location. */
170 is_root (char const *dir
)
172 char *resolved
= canonicalize_file_name (dir
);
173 bool is_res_root
= resolved
&& STREQ ("/", resolved
);
181 if (status
!= EXIT_SUCCESS
)
186 Usage: %s [OPTION] NEWROOT [COMMAND [ARG]...]\n\
188 "), program_name
, program_name
);
191 Run COMMAND with root directory set to NEWROOT.\n\
196 --groups=G_LIST specify supplementary groups as g1,g2,..,gN\n\
199 --userspec=USER:GROUP specify user and group (ID or name) to use\n\
202 --skip-chdir do not change working directory to %s\n\
205 fputs (HELP_OPTION_DESCRIPTION
, stdout
);
206 fputs (VERSION_OPTION_DESCRIPTION
, stdout
);
209 If no command is given, run '\"$SHELL\" -i' (default: '/bin/sh -i').\n\
211 emit_exec_status (PROGRAM_NAME
);
212 emit_ancillary_info (PROGRAM_NAME
);
218 main (int argc
, char **argv
)
222 /* Input user and groups spec. */
223 char *userspec
= nullptr;
224 char const *username
= nullptr;
225 char const *groups
= nullptr;
226 bool skip_chdir
= false;
228 /* Parsed user and group IDs. */
231 GETGROUPS_T
*out_gids
= nullptr;
234 initialize_main (&argc
, &argv
);
235 set_program_name (argv
[0]);
236 setlocale (LC_ALL
, "");
237 bindtextdomain (PACKAGE
, LOCALEDIR
);
238 textdomain (PACKAGE
);
240 initialize_exit_failure (EXIT_CANCELED
);
241 atexit (close_stdout
);
243 while ((c
= getopt_long (argc
, argv
, "+", long_opts
, nullptr)) != -1)
250 /* Treat 'user:' just like 'user'
251 as we lookup the primary group by default
252 (and support doing so for UIDs as well as names. */
253 size_t userlen
= strlen (userspec
);
254 if (userlen
&& userspec
[userlen
- 1] == ':')
255 userspec
[userlen
- 1] = '\0';
267 case_GETOPT_HELP_CHAR
;
269 case_GETOPT_VERSION_CHAR (PROGRAM_NAME
, AUTHORS
);
272 usage (EXIT_CANCELED
);
278 error (0, 0, _("missing operand"));
279 usage (EXIT_CANCELED
);
282 char const *newroot
= argv
[optind
];
283 bool is_oldroot
= is_root (newroot
);
285 if (! is_oldroot
&& skip_chdir
)
287 error (0, 0, _("option --skip-chdir only permitted if NEWROOT is old %s"),
289 usage (EXIT_CANCELED
);
294 /* We have to look up users and groups twice.
295 - First, outside the chroot to load potentially necessary passwd/group
296 parsing plugins (e.g. NSS);
297 - Second, inside chroot to redo parsing in case IDs are different.
298 Within chroot lookup is the main justification for having
299 the --user option supported by the chroot command itself. */
301 ignore_value (parse_user_spec (userspec
, &uid
, &gid
, nullptr, nullptr));
303 /* If no gid is supplied or looked up, do so now.
304 Also lookup the username for use with getgroups. */
305 if (uid_set (uid
) && (! groups
|| gid_unset (gid
)))
307 const struct passwd
*pwd
;
308 if ((pwd
= getpwuid (uid
)))
312 username
= pwd
->pw_name
;
316 if (groups
&& *groups
)
317 ignore_value (parse_additional_groups (groups
, &out_gids
, &n_gids
,
320 else if (! groups
&& gid_set (gid
) && username
)
322 int ngroups
= xgetgroups (username
, gid
, &out_gids
);
329 if (chroot (newroot
) != 0)
330 error (EXIT_CANCELED
, errno
, _("cannot change root directory to %s"),
333 if (! skip_chdir
&& chdir ("/"))
334 error (EXIT_CANCELED
, errno
, _("cannot chdir to root directory"));
336 if (argc
== optind
+ 1)
338 /* No command. Run an interactive shell. */
339 char *shell
= getenv ("SHELL");
340 if (shell
== nullptr)
341 shell
= bad_cast ("/bin/sh");
343 argv
[1] = bad_cast ("-i");
348 /* The following arguments give the command. */
352 /* Attempt to set all three: supplementary groups, group ID, user ID.
353 Diagnose any failures. If any have failed, exit before execvp. */
357 char const *err
= parse_user_spec_warn (userspec
, &uid
, &gid
,
358 nullptr, nullptr, &warn
);
360 error (warn
? 0 : EXIT_CANCELED
, 0, "%s", (err
));
363 /* If no gid is supplied or looked up, do so now.
364 Also lookup the username for use with getgroups. */
365 if (uid_set (uid
) && (! groups
|| gid_unset (gid
)))
367 const struct passwd
*pwd
;
368 if ((pwd
= getpwuid (uid
)))
372 username
= pwd
->pw_name
;
374 else if (gid_unset (gid
))
376 error (EXIT_CANCELED
, errno
,
377 _("no group specified for unknown uid: %d"), (int) uid
);
381 GETGROUPS_T
*gids
= out_gids
;
382 GETGROUPS_T
*in_gids
= nullptr;
383 if (groups
&& *groups
)
385 if (parse_additional_groups (groups
, &in_gids
, &n_gids
, !n_gids
) != 0)
388 return EXIT_CANCELED
;
389 /* else look-up outside the chroot worked, then go with those. */
395 else if (! groups
&& gid_set (gid
) && username
)
397 int ngroups
= xgetgroups (username
, gid
, &in_gids
);
401 error (EXIT_CANCELED
, errno
,
402 _("failed to get supplemental groups"));
403 /* else look-up outside the chroot worked, then go with those. */
413 if ((uid_set (uid
) || groups
) && setgroups (n_gids
, gids
) != 0)
414 error (EXIT_CANCELED
, errno
, _("failed to set supplemental groups"));
419 if (gid_set (gid
) && setgid (gid
))
420 error (EXIT_CANCELED
, errno
, _("failed to set group-ID"));
422 if (uid_set (uid
) && setuid (uid
))
423 error (EXIT_CANCELED
, errno
, _("failed to set user-ID"));
425 /* Execute the given command. */
426 execvp (argv
[0], argv
);
428 int exit_status
= errno
== ENOENT
? EXIT_ENOENT
: EXIT_CANNOT_INVOKE
;
429 error (0, errno
, _("failed to run command %s"), quote (argv
[0]));