vpl-jail-system.initd

#!/bin/bash
#
# Startup script for vpl-jail-system
#
# author:     Juan Carlos Rodriguez-del-Pino <jcrodriguez@dis.ulpgc.es>
# license:    GPL v3 see http://www.gnu.org/licenses/gpl

# chkconfig:  345 99 36
# description: Virtual Programming Lab jail is a sandbox to compile \
#              and execute programs. vpl-jail-server receive the code\
#              and execution restrictions and return \
#              the results to  the client. \
#              This script build jail filesystem and start \
#              or stop the vpl-jail-server.
# processname: vpl-jail-system
#
### BEGIN INIT INFO
# Provides:       vpl-jail-system
# Required-Start: $network
# Required-Stop:  $network
# Default-Start:  2 3 4 5
# Default-Stop:   0 1 6
# Short-Description: VPL for Moodle jail service
# Description: build jail filesystem and start or stop the vpl-jail-server
### END INIT INFO

# Jail filesystem structure $JAILPATH overlayfs of / with nosuid
# $JAILPATH____ dev       #fake with minimum files
#          |     |___ pts #Replicate original
#          |     |___ shm #tmpfs
#          |___ etc       #Replaced passwd and group
#          |___ home      #Dir to create suitable prisoner home dir
#          |___ proc      #Real dir by mount --bind
#          |___ run       #Real dir by mount --bind
#          |     |___ lock #Real dir by mount --bind

umask 077
LOGFILE=/var/log/vpl-jail-service.log
touch $LOGFILE &> /dev/null
chmod 600 $LOGFILE
VPL_PROGRAMS_DIR=/usr/sbin/vpl
VPL_CONFIG_DIR=/etc/vpl
DAEMON=$VPL_PROGRAMS_DIR/vpl-jail-server
PIDFILE=/run/vpl-jail-server.pid
NOMOUNT="^vpl|^init|^ldap|^udev|grub|^rc[0-6S]|^pam|^cron|^apm|^logrotate"
NOMOUNT="$NOMOUNT|^mail|^rsyslog|^shadow|^security|^ssl|^ssh|^update"

if [ "$2" == "foreground" ] ; then
	LOGFILE=/dev/stdout
fi
if [ "$(command -v systemctl)" = "" ] ; then
	# Try to use lsb init-functions
	if [ -x  /lib/lsb/init-functions ] ; then
		. /lib/lsb/init-functions
	fi
fi
# If lsb init-functions not working define owns
declare -f log_failure_msg &> /dev/null
if [ "$?" == "1" ] ; then 
	function log_failure_msg {
		echo $1
	}
	function log_success_msg {
		echo $1
	}
fi

declare -f start_daemon &> /dev/null
if [ "$?" == "1" ] ; then 
	function start_daemon {
		$1 $2 $3 &
		echo $! > "$PIDFILE"
	}
fi

function read_config_var {
	local FILE=$1
	shift
	while (( "$#" )); do
		local ENVCONFIGVAR="VPL_JAIL_$1"
		if [ -n "${!ENVCONFIGVAR}" ] ; then
			echo "$1=${!ENVCONFIGVAR} (using value from env var $ENVCONFIGVAR)" >> $LOGFILE
			export $1=${!ENVCONFIGVAR}
		else
			local RES=$(grep -i -e "^[ \\t]*$1[ \\t]*=" $FILE \
					| tail -n 1 \
					| sed -e "s/^[ \\t]*$1[ \\t]*=[ \\t]*\\(.*\\)\$/\\1/I")
			if [ -n "$RES" ] ; then
				echo "$1=$RES (using value from configuration file)" >> $LOGFILE
				export $1=$RES
			else
				echo "$1=$2 (using the default value)" >> $LOGFILE
				export $1=$2
			fi
	    fi
		shift
		shift
	done
}

function create_check_dir {
	if [ -d "$1" ] ; then
		if [ "$(stat -c "%d:%i" /)" == "$(stat -c "%d:%i" $1)" ] ; then
			log_failure_msg $"vpl-jail-system error in configuration: root directory used"
			exit 1
		fi
	fi
	if [ ! -d "$1" ] ; then
		mkdir -p "$1"
		if [ "$?" != "0" ] ; then
			log_failure_msg $"Can't mkdir $1"
			exit 2
		fi
	fi
	chmod $2 "$1" &>/dev/null
}

function run_root_script {
	if [ -s "$1" ] ; then
		if [ "$(stat -c '%u' $1)" = "0" ] ; then
			$1
		else
			log_failure_msg $"Security error: script $1 did not run, due to not being owned by the user root"
		fi
	fi
}

function vpl_umount {
	if mount | grep -q " on $1 "; then
	    umount -l -f "$1"
		return $?
	fi
	return 1
}

function pre_start {
	run_root_script $VPL_PROGRAMS_DIR/pre_start.sh
}
function post_stop {
	run_root_script $VPL_PROGRAMS_DIR/post_stop.sh
}

function set_etc {
	local PASSWORDFILE="$JAILPATH/etc/passwd"
	local GROUPFILE="$JAILPATH/etc/group"
	local SHADOWFILE="$JAILPATH/etc/shadow"
	local I
	if [ -z "$IN_CONTAINER" ] ; then
		#passwd file
		echo "root:*:0:0:root:/root:/bin/bash" > "$PASSWORDFILE"
		for (( I=$MIN_PRISONER_UGID ; $I < $MAX_PRISONER_UGID ; I+=1 )) ; do
			echo "p$I:*:$I:$I:prisoner $I:/home/p$I:/bin/bash" >> "$PASSWORDFILE"
		done
		chmod 644 "$PASSWORDFILE"
		#group file
		echo "root:*:0:root" > "$GROUPFILE"
		for (( I=$MIN_PRISONER_UGID ; $I < $MAX_PRISONER_UGID ; I+=1 )) ; do
			echo "p$I:*:$I:p$I" >> "$GROUPFILE"
		done
		chmod 644 "$GROUPFILE"
		chown root:root "$SHADOWFILE"
		chmod 600 "$SHADOWFILE"
	else
		#passwd file
		local TMPFILE=/tmp/.nothing
		grep -v "^p[0-9][0-9][0-9]+:" "$PASSWORDFILE" > $TMPFILE
		for (( I=$MIN_PRISONER_UGID ; $I < $MAX_PRISONER_UGID ; I+=1 )) ; do
			echo "p$I:*:$I:$I:prisoner $I:/home/p$I:/bin/bash" >> $TMPFILE
		done
		cp $TMPFILE "$PASSWORDFILE"
		chown root:root "$PASSWORDFILE"
		chmod 644 "$PASSWORDFILE"

		#group file
		grep -v "^p[0-9][0-9][0-9]+:" "$GROUPFILE" > $TMPFILE
		for (( I=$MIN_PRISONER_UGID ; $I < $MAX_PRISONER_UGID ; I+=1 )) ; do
			echo "p$I:*:$I:p$I" >> $TMPFILE
		done
		cp $TMPFILE "$GROUPFILE"
		chown root:root "$GROUPFILE"
		chmod 644 "$GROUPFILE"
		rm $TMPFILE
	fi
}

function set_tmpdir {
	if [ "$2" == "" ] ; then
		echo "Error mounting $JAILPATH$1 : no SIZE set"
	fi
	local mask=0711
	if [ "$3" != "" ] ; then
		mask=$3
	fi
	unset_tmpdir $1
	create_check_dir "$JAILPATH$1" $mask
	if [ "${USETMPFS,,}" != "false" ] ; then 
		mount -t tmpfs -osize="$2" tmpfs "$JAILPATH$1"
	fi
}

function unset_tmpdir {
	vpl_umount "$JAILPATH$1"
}

function set_other {
	if [ -d $1 ] ; then
		create_check_dir "$JAILPATH$1" $(stat -c %a $1)
		mount --bind $1 "$JAILPATH$1"
		mount -o remount${NOSUID},bind "$JAILPATH$1"
	fi
}

function unset_other {
	vpl_umount "$JAILPATH$1"
}

function set_snap {
	if [ -d "$JAILPATH/snap" ] ; then
		for DIR in $(ls -d /snap/*/* 2>/dev/null)
		do
			if [ ! -h $DIR ] ; then
				set_other $DIR
			fi
		done
	fi
}

function unset_snap {
	if [ -d "$JAILPATH/snap" ] ; then
		for DIR in $(ls -d /snap/*/* 2>/dev/null)
		do
			if [ ! -h $DIR ] ; then
				unset_other $DIR
			fi
		done
	fi
}

function set_firewall {
#0: No firewall
#1: VPL service+DNS+ full internet access
#2: VPL service+DNS+ Limit internet to port 80 and 443 (super user unlimited)
#3: VPL service+No internet to normal users (super user unlimited)
#4: VPL service+No internet to all users (No graphics, only console execution)
	local OWN="127.0.0.0/8,$(hostname -I)"
	if [ "$FIREWALL" \> "0" ] ; then
		iptables -N VPL_LOG
		iptables -N VPL_IN 
		iptables -N VPL_OUT
		#Logs
		[ "$1" != "" ] && (iptables -A VPL_LOG -m limit --limit 20/minute -j LOG --log-prefix "VPL packet dropped: " --log-level 7)
		iptables -A VPL_LOG -j DROP
		#input
		iptables -A VPL_IN -p tcp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
		#Avoid auto request to vpl service
		iptables -A VPL_IN -p tcp -m multiport -s $OWN -d $OWN --dports $PORT,$SECURE_PORT -j VPL_LOG
		#Accept connection to vpl service
		iptables -A VPL_IN -p tcp -m multiport --dports $PORT,$SECURE_PORT -j ACCEPT
		#Accept local conections
		iptables -A VPL_IN -p tcp -s $OWN -j ACCEPT
		#DNS query
		[ "$FIREWALL" \< "3" ] && (iptables -A VPL_IN -p udp --sport 53 -j ACCEPT)
		[ "$FIREWALL" \< "3" ] && (iptables -A VPL_IN -p tcp --sport 53 -j ACCEPT)
		iptables -A VPL_IN -j VPL_LOG
		#Output
		#Accept established connections
		iptables -A VPL_OUT -p tcp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
		#Accept all from super user
		[ "$FIREWALL" \< "4" ] && (iptables -A VPL_OUT -m owner --uid-owner 0 -j ACCEPT)
		#Drop auto connections to VPL service
		iptables -A VPL_OUT -p tcp -m conntrack --ctstate NEW -m multiport -s $OWN -d $OWN --dports $PORT,$SECURE_PORT -j VPL_LOG
		#Accept request to internet
		[ "$FIREWALL" == "1" ] && (iptables -A VPL_OUT -p tcp -m conntrack --ctstate NEW -j ACCEPT)
		#Accept request to internet only 80,443
		[ "$FIREWALL" == "2" ] && (iptables -A VPL_OUT -p tcp -m conntrack --ctstate NEW -m multiport --dports 80,443 -j ACCEPT)
		#Accept DNS requests
		[ "$FIREWALL" \< "3" ] && (iptables -A VPL_OUT -p udp --dport 53 -j ACCEPT)
		[ "$FIREWALL" \< "3" ] && (iptables -A VPL_OUT -p tcp --dport 53 -j ACCEPT)
		#Accept Auto conections (php builtin server, etc)
		[ "$FIREWALL" \< "4" ] && (iptables -A VPL_OUT -p tcp -m conntrack --ctstate NEW -s $OWN -d $OWN -j ACCEPT)
		iptables -A VPL_OUT -j VPL_LOG
		iptables -A INPUT -j VPL_IN
		iptables -A OUTPUT -j VPL_OUT
	fi
}

function unset_firewall {
	#try to remove the VPL config in any case
	{
		iptables -D INPUT -j VPL_IN
		iptables -F VPL_IN
		iptables -X VPL_IN
		iptables -D OUTPUT -j VPL_OUT
		iptables -F VPL_OUT
		iptables -X VPL_OUT
		iptables -F VPL_LOG
		iptables -X VPL_LOG
	} &> /dev/null
}

function read_config {
	case "$1" in
  		stop)
        	local CONFIG_FILE="$VPL_CONFIG_DIR/vpl-jail-system.conf.LAST"
        ;;
		*)
			local CONFIG_FILE="$VPL_CONFIG_DIR/vpl-jail-system.conf"
			cp "$CONFIG_FILE" "$CONFIG_FILE.LAST"
        ;;
	esac
	if [ ! -f "$CONFIG_FILE" ] ; then
		CONFIG_FILE="$VPL_CONFIG_DIR/vpl-jail-system.conf"
	fi
	#Load config file
	if [ -f "$CONFIG_FILE" ] ; then
		read_config_var "$CONFIG_FILE" JAILPATH /jail
		read_config_var "$CONFIG_FILE" MIN_PRISONER_UGID 10000 MAX_PRISONER_UGID 20000
		read_config_var "$CONFIG_FILE" CONTROLPATH /var/vpl-jail-system
		read_config_var "$CONFIG_FILE" PORT 80 SECURE_PORT 443
		read_config_var "$CONFIG_FILE" FIREWALL 0
		read_config_var "$CONFIG_FILE" ALLOWSUID false
		read_config_var "$CONFIG_FILE" USETMPFS true
		read_config_var "$CONFIG_FILE" CERTBOT_WEBROOT_PATH
		if [ "${USETMPFS,,}" != "false" ] ; then
			read_config_var "$CONFIG_FILE" HOMESIZE 30%			
		else
			read_config_var "$CONFIG_FILE" HOMESIZE 2Gb			
		fi
		read_config_var "$CONFIG_FILE" SHMSIZE 30%
		NOSUID=,nosuid
		if [ "${ALLOWSUID,,}" == "true" ] ; then
			NOSUID=
		fi
	else
		log_failure_msg $"vpl-jail-system config file not found: $CONFIG_FILE"
		exit 3
	fi
}

function set_controldir {
	local JAIL_LIVE="$CONTROLPATH/jail_live"
	local JAIL_WORK="$CONTROLPATH/jail_work"
	vpl_umount "$CONTROLPATH"
	rm -Rf "$JAIL_LIVE" &> /dev/null
	rm -Rf "$JAIL_WORK" &> /dev/null
	rm -Rf "$CONTROLPATH" &> /dev/null
	create_check_dir "$CONTROLPATH" 0700
	if [ -z "$IN_CONTAINER" ] ; then
		if [ "${USETMPFS,,}" != "false" ] ; then 
			mount -t tmpfs -o size=$HOMESIZE tmpfs "$CONTROLPATH"
		else
			if [ `expr index "%" "$HOMESIZE"` != "0" ] ; then
				log_failure_msg $"Please use a fixed size for HOMESIZE. E.g. 2G, 1500M"
				exit 2
			fi
			local CONTROLFS="${CONTROLPATH}.fs"
			if [ -f "$CONTROLFS" ] ; then
				rm "$CONTROLFS"
			fi
			touch "$CONTROLFS"
			chmod 0600 "$CONTROLFS" 
			truncate --size $HOMESIZE "$CONTROLFS"
			mkfs.ext3 "$CONTROLFS" &> /dev/null
			mount "$CONTROLFS" "$CONTROLPATH"
		fi
		chmod 0700 "$CONTROLPATH"	
		create_check_dir "$JAIL_LIVE" 0700
		create_check_dir "$JAIL_WORK" 0700
	fi
}

function unset_controldir {
	vpl_umount "$CONTROLPATH"
	local CONTROLFS="${CONTROLPATH}.fs"
	if [ -f "$CONTROLFS" ] ; then
		rm "$CONTROLFS"
	fi
}

function check_selinux_vpl {
	if [ -x "$(command -v sestatus)" ] && [ ! "$(sestatus | grep -i 'disable')" ] ; then
		log_failure_msg "SELinux state: enforcing or permissive. SELinux must be You must disabled"
	fi
}

function start_vpl {
	if [ -f $PIDFILE ] ; then
		stop_vpl
	fi
	{
		pre_start
		check_selinux_vpl
		read_config start
		set_controldir
		if [ "$CERTBOT_WEBROOT_PATH" != "" ] ; then
			create_check_dir "$CERTBOT_WEBROOT_PATH" 0700
		fi
		if [ -z "$IN_CONTAINER" ] ; then
			create_check_dir "$JAILPATH" 0755
			local JAIL_LIVE="$CONTROLPATH/jail_live"
			local JAIL_WORK="$CONTROLPATH/jail_work"
			mount -t overlay overlay -olowerdir=/,upperdir=$JAIL_LIVE,workdir=$JAIL_WORK${NOSUID} "$JAILPATH"
			chmod 0755 "$JAILPATH"
			if [ "$?" != "0" ] ; then
				log_failure_msg $"Error mounting jail dir"
				exit 4
			fi
			rm -Rf "$JAILPATH/home" &> /dev/null
			rm -Rf "$JAILPATH/jail" &> /dev/null
			rm -Rf "$JAILPATH/etc/vpl" &> /dev/null
			rm -Rf "$JAILPATH/$CONTROLPATH" &> /dev/null
			create_check_dir "$JAILPATH/home" 0711
			set_other /proc
			set_other /dev
			set_tmpdir /dev/shm $SHMSIZE 1777
			set_other /dev/pts
			set_other /run
			set_other /run/lock
			set_snap
		fi
		set_etc
	} 2>> $LOGFILE
	if [ "$1" == "foreground" ] ; then
		trap "signal_stop_vpl" SIGTERM
		echo
		if [ -n "$IN_CONTAINER" ] ; then
			echo "Starting in container in foreground mode (nondaemon mode)"
			$DAEMON in_container foreground $2 $3 &
		else
			echo "Starting in foreground mode (nondaemon mode)"
			$DAEMON foreground $2 $3 &
		fi
		wait $!
	else
		start_daemon $DAEMON $1 $2
		sleep 1
		if [ -f $PIDFILE ] ; then
			set_firewall $1
		else
			log_failure_msg $"Daemon not started"
		fi
	fi
}

function stop_vpl {
	{
		read_config stop
		if [ "$(command -v killproc)" != "" ] ; then
			killproc $DAEMON 15
		fi
		if [ -f $PIDFILE ] ; then
			kill -15 $(cat $PIDFILE) &> /dev/null
			sleep 1
			kill -9 $(cat $PIDFILE) &> /dev/null
			rm $PIDFILE
		fi
		if [ -z "$IN_CONTAINER" ] ; then
			if [ -d "$JAILPATH" ] ; then
				if [ "$(stat -c "%d:%i" /)" == "$(stat -c "%d:%i" $JAILPATH)" ] ; then
					log_failure_msg $"vpl-jail-system error jail path is the root directory"
					exit 5
				fi
			fi

			unset_snap
			unset_other /run/lock
			unset_other /run
			unset_other /dev/pts
			unset_tmpdir /dev/shm
			unset_other /dev
			unset_other /proc
			if [ -d "$JAILPATH" ] ; then
				local I
				for (( I=1 ; $I < 4 ; I+=1 )) ; do
					vpl_umount "$JAILPATH" &> /dev/null
					if [ "$?" == "0" ] ;  then
						break
					fi
					sleep 1
				done
				vpl_umount "$JAILPATH"
			fi
		fi
		unset_controldir
		unset_firewall
		post_stop
	} 2>> $LOGFILE
}

function chek_running_in_container() {
	# Set IN_CONTAINER to yes if running in container and JAIL_PATH = /
	local USING_OVERLAY
	if [ -x "$(command -v mount)" ] ; then
		mount | grep -q "^overlay on / type overlay"
		USING_OVERLAY=$?
	elif [ -x "$(command -v stat)" ] ; then
		stat -f -c "%T" / | grep -q "^overlay"
		USING_OVERLAY=$?
	elif [ -f "/etc/mtab" ] ; then
		grep -q "^overlay on / type overlay" /etc/mtab
		USING_OVERLAY=$?
	else
		return
	fi
	[[ $USING_OVERLAY != 0 && $JAILPATH == "/" ]] && (echo "Error: trying to use "/" as jail mount and not in container"; exit 1)
	IN_CONTAINER=
	[[ $USING_OVERLAY = 0 && $JAILPATH == "/" ]] && IN_CONTAINER=yes
	[ -n "$IN_CONTAINER" ] && echo "Detected running in container"
}

function signal_stop_vpl() {
	log_success_msg $"Stopping by signal vpl-jail-system service:"
	stop_vpl
}

echo "===== vpl-jail-system ======" >> $LOGFILE
read_config init
chek_running_in_container
date >> $LOGFILE
case "$1" in
	start)
		log_success_msg $"Starting vpl-jail-system service:"
        start_vpl $2 $3 $4
        ;;
	stop)
  		log_success_msg $"Stopping vpl-jail-system service:"
        stop_vpl
        ;;
	restart)
  		log_success_msg $"Restarting vpl-jail-system service:"
        stop_vpl
        start_vpl $2 $3 $4
        ;;
	start_foreground)
  		log_success_msg $"Starting vpl-jail-system service in foregorund mode:"
        stop_vpl
        start_vpl foreground $2 $3 $4
        ;;
	force-reload)
  		log_success_msg $"Force-reload vpl-jail-system service:"
        stop_vpl
        start_vpl $2 $3 $4
        ;;
	status)
        pidof $DAEMON
	    exit $? 
        ;;
	*)
        log_failure_msg $"Usage: vpl-jail-system {start|stop|restart|force-reaload|status}"
        exit 7
esac
exit 0