minijail: Add support for dropping caps with static binaries am: fe5fb8ea50 am: 5302f58f1c

am: ab5309116f

Change-Id: If3edf723305edeef2a602e7c71fa70ee797fc096

2 files changed, 41 insertions, 21 deletions

diff --git a/libminijail.c b/libminijail.c
index b119542..6381c30 100644
--- a/libminijail.c
+++ b/libminijail.c
@@ -2011,9 +2011,11 @@ int minijail_run_internal(struct minijail *j, const char *filename,
 	}
 
 	if (!use_preload) {
-		if (j->flags.use_caps && j->caps != 0)
-			die("non-empty capabilities are not supported without "
-			    "LD_PRELOAD");
+		if (j->flags.use_caps && j->caps != 0 &&
+		    !j->flags.set_ambient_caps) {
+			die("non-empty, non-ambient capabilities are not "
+			    "supported without LD_PRELOAD");
+		}
 	}
 
 	/*
diff --git a/minijail0.c b/minijail0.c
index 017c1bf..fb98163 100644
--- a/minijail0.c
+++ b/minijail0.c
@@ -523,44 +523,62 @@ static int parse_args(struct minijail *j, int argc, char *argv[],
 		free((void *)filter_path);
 	}
 
+	/*
+	 * There should be at least one additional unparsed argument: the
+	 * executable name.
+	 */
 	if (argc == optind) {
 		usage(argv[0]);
 		exit(1);
 	}
 
-	return optind;
-}
-
-int main(int argc, char *argv[])
-{
-	struct minijail *j = minijail_new();
-	const char *dl_mesg = NULL;
-	int exit_immediately = 0;
-	ElfType elftype = ELFERROR;
-	int consumed = parse_args(j, argc, argv, &exit_immediately, &elftype);
-	argc -= consumed;
-	argv += consumed;
-
-	if (elftype == ELFERROR) {
+	if (*elftype == ELFERROR) {
 		/*
 		 * -T was not specified.
 		 * Get the path to the program adjusted for changing root.
 		 */
-		char *program_path = minijail_get_original_path(j, argv[0]);
+		char *program_path =
+		    minijail_get_original_path(j, argv[optind]);
 
 		/* Check that we can access the target program. */
 		if (access(program_path, X_OK)) {
 			fprintf(stderr,
 				"Target program '%s' is not accessible.\n",
-				argv[0]);
-			return 1;
+				argv[optind]);
+			exit(1);
 		}
 
 		/* Check if target is statically or dynamically linked. */
-		elftype = get_elf_linkage(program_path);
+		*elftype = get_elf_linkage(program_path);
 		free(program_path);
 	}
 
+	/*
+	 * Setting capabilities need either a dynamically-linked binary, or the
+	 * use of ambient capabilities for them to be able to survive an
+	 * execve(2).
+	 */
+	if (caps && *elftype == ELFSTATIC && !ambient_caps) {
+		fprintf(stderr, "Can't run statically-linked binaries with "
+				"capabilities (-c) without also setting "
+				"ambient capabilities. Try passing "
+				"--ambient.\n");
+		exit(1);
+	}
+
+	return optind;
+}
+
+int main(int argc, char *argv[])
+{
+	struct minijail *j = minijail_new();
+	const char *dl_mesg = NULL;
+	int exit_immediately = 0;
+	ElfType elftype = ELFERROR;
+	int consumed = parse_args(j, argc, argv, &exit_immediately, &elftype);
+	argc -= consumed;
+	argv += consumed;
+
 	if (elftype == ELFSTATIC) {
 		/*
 		 * Target binary is statically linked so we cannot use