Merge pull request #2037 from tych0/usermode-helper

add a static usermode helper

kernel/kernel_config-4.11.x

@@ -3560,7 +3560,8 @@ CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
 CONFIG_HAVE_ARCH_HARDENED_USERCOPY=y
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
-# CONFIG_STATIC_USERMODEHELPER is not set
+CONFIG_STATIC_USERMODEHELPER=y
+CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/usermode-helper"
 # CONFIG_SECURITY_SELINUX is not set
 # CONFIG_SECURITY_SMACK is not set
 # CONFIG_SECURITY_TOMOYO is not set

pkg/init/Dockerfile

@@ -1,3 +1,9 @@
+FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS build
+RUN apk add --no-cache --initdb alpine-baselayout make gcc musl-dev
+
+ADD usermode-helper.c .
+RUN make usermode-helper
+
 FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out alpine-baselayout busybox musl
@@ -9,6 +15,7 @@ FROM scratch
 ENTRYPOINT []
 CMD []
 WORKDIR /
+COPY --from=build usermode-helper /sbin/
 COPY --from=mirror /out/ /
 COPY init /
 COPY etc etc/

pkg/init/Makefile

@@ -3,7 +3,7 @@ default: push
 
 ORG?=linuxkit
 IMAGE=init
-DEPS=Dockerfile init $(wildcard etc/*) $(wildcard etc/init.d/*)
+DEPS=Dockerfile init $(wildcard etc/*) $(wildcard etc/init.d/*) usermode-helper.c
 
 HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
 

pkg/init/usermode-helper.c

@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[])
+{
+	int i;
+
+	/* TODO: this doesn't go anywhere useful right now. It would be nice to
+	 * switch this to syslog() (or some other mechanism) so that we can
+	 * actually read the contents.
+	 */
+	fprintf(stderr, "usermodehelper: ");
+	for (i = 0; i < argc; i++) {
+		fprintf(stderr, "%s ", argv[i]);
+	}
+	fprintf(stderr, "\n");
+
+	if (!strcmp(argv[0], "/sbin/mdev")) {
+		/* busybox uses /sbin/mdev for early uevent bootstrapping */
+		execv(argv[0], argv);
+	} else if (!strcmp(argv[0], "/sbin/modprobe")) {
+		/* allow modprobe */
+		execv(argv[0], argv);
+	} else if (!strcmp(argv[0], "/sbin/poweroff") ||
+			!strcmp(argv[0], "/sbin/reboot")) {
+		/* poweroff and reboot are allowed */
+		execv(argv[0], argv);
+	} else {
+		/* This means either we got an unexpected call from the kernel
+		 * or someone is doing something nefarious. Some other possible
+		 * expected callers are:
+		 *  - for core dumps. we don't have a "core" binary, and don't
+		 *    set this by default to anything. when we do, we need to
+		 *    whitelist it here
+		 *  - /linuxrc: we're not doing legacy root setup, so we don't
+		 *     need this
+		 *  - a few drivers and filesystems (drbd, nfs, nfsd, ocfs2)
+		 *  - cgroup notify_on_release handlers, which we do not set
+		 *    (but e.g. systemd needs, if anyone ever tries to boot
+		 *    that on linuxkit)
+		 *  - /sbin/request-key, which we don't provide
+		 *  - on x86, machine check
+		 *
+		 * Today we only call mdev and modprobe, but as we add more
+		 * features to linuxkit this whitelist may need changing (or a
+		 * policy, like always allow stuff in /sbin).
+		 */
+		exit(2);
+	}
+
+	perror("exec failed");
+	return 1;
+}