Signed-off-by: Maisem Ali <maisem@tailscale.com>main
Maisem Ali
4 years ago
committed by
Maisem Ali
parent
ba2c0c3145
commit
06c147d848
@ -0,0 +1,288 @@ |
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// This file contains the code for the incubator process.
|
||||
// Taiscaled launches the incubator as the same user as it was launched as.
|
||||
// The incbuator then registers a new session with the OS, sets its own UID to
|
||||
// the specified `--uid`` and then lauches the requested `--cmd`.
|
||||
|
||||
//go:build linux || (darwin && !ios)
|
||||
// +build linux darwin,!ios
|
||||
|
||||
package tailssh |
||||
|
||||
import ( |
||||
"context" |
||||
"flag" |
||||
"fmt" |
||||
"io" |
||||
"log" |
||||
"log/syslog" |
||||
"os" |
||||
"os/exec" |
||||
"os/user" |
||||
"runtime" |
||||
"strings" |
||||
"syscall" |
||||
|
||||
"github.com/creack/pty" |
||||
"github.com/gliderlabs/ssh" |
||||
"golang.org/x/sys/unix" |
||||
"tailscale.com/cmd/tailscaled/childproc" |
||||
"tailscale.com/types/logger" |
||||
) |
||||
|
||||
func init() { |
||||
childproc.Add("ssh", beIncubator) |
||||
} |
||||
|
||||
var ptyName = func(f *os.File) (string, error) { |
||||
return "", fmt.Errorf("unimplemented") |
||||
} |
||||
|
||||
// maybeStartLoginSession starts a new login session for the specified UID.
|
||||
// On success, it may return a non-nil close func which must be closed to
|
||||
// release the session.
|
||||
// See maybeStartLoginSessionLinux.
|
||||
var maybeStartLoginSession = func(logf logger.Logf, uid uint32, localUser, remoteUser, remoteHost, tty string) (close func() error, err error) { |
||||
return nil, nil |
||||
} |
||||
|
||||
// newIncubatorCommand returns a new exec.Cmd configured with
|
||||
// `tailscaled be-child ssh` as the entrypoint.
|
||||
// If tailscaled is empty, the desired cmd is executed directly.
|
||||
func newIncubatorCommand(ctx context.Context, ci *sshConnInfo, lu *user.User, tailscaled, name string, args []string) *exec.Cmd { |
||||
if tailscaled == "" { |
||||
return exec.CommandContext(ctx, name, args...) |
||||
} |
||||
remoteUser := ci.uprof.LoginName |
||||
if len(ci.node.Tags) > 0 { |
||||
remoteUser = strings.Join(ci.node.Tags, ",") |
||||
} |
||||
|
||||
incubatorArgs := []string{ |
||||
"be-child", |
||||
"ssh", |
||||
"--uid=" + lu.Uid, |
||||
"--local-user=" + lu.Name, |
||||
"--remote-user=" + remoteUser, |
||||
"--remote-ip=" + ci.src.IP().String(), |
||||
"--cmd=" + name, |
||||
} |
||||
|
||||
if len(args) > 0 { |
||||
incubatorArgs = append(incubatorArgs, fmt.Sprintf("--cmd-args=%q", strings.Join(args, " "))) |
||||
} |
||||
return exec.CommandContext(ctx, tailscaled, incubatorArgs...) |
||||
} |
||||
|
||||
const debugIncubator = false |
||||
|
||||
// beIncubator is the entrypoint to the `tailscaled be-child ssh` subcommand.
|
||||
// It is responsible for informing the system of a new login session for the user.
|
||||
// This is sometimes necessary for mounting home directories and decrypting file
|
||||
// systems.
|
||||
//
|
||||
// Taiscaled launches the incubator as the same user as it was launched as.
|
||||
// The incbuator then registers a new session with the OS, sets its own UID to
|
||||
// the specified `--uid`` and then lauches the requested `--cmd`.
|
||||
func beIncubator(args []string) error { |
||||
var ( |
||||
flags = flag.NewFlagSet("", flag.ExitOnError) |
||||
uid = flags.Uint64("uid", 0, "the uid of local-user") |
||||
localUser = flags.String("local-user", "", "the user to run as") |
||||
remoteUser = flags.String("remote-user", "", "the remote user/tags") |
||||
remoteIP = flags.String("remote-ip", "", "the remote Tailscale IP") |
||||
ttyName = flags.String("tty-name", "", "the tty name (pts/3)") |
||||
hasTTY = flags.Bool("has-tty", false, "is the output attached to a tty") |
||||
cmdName = flags.String("cmd", "", "the cmd to launch") |
||||
cmdArgs = flags.String("cmd-args", "", "the args for cmd") |
||||
) |
||||
if err := flags.Parse(args); err != nil { |
||||
return err |
||||
} |
||||
logf := logger.Discard |
||||
if debugIncubator { |
||||
// We don't own stdout or stderr, so the only place we can log is syslog.
|
||||
if sl, err := syslog.New(syslog.LOG_INFO|syslog.LOG_DAEMON, "tailscaled-ssh"); err == nil { |
||||
logf = log.New(sl, "", 0).Printf |
||||
} |
||||
} |
||||
|
||||
euid := uint64(os.Geteuid()) |
||||
// Inform the system that we are about to log someone in.
|
||||
// We can only do this if we are running as root.
|
||||
sessionCloser, err := maybeStartLoginSession(logf, uint32(*uid), *localUser, *remoteUser, *remoteIP, *ttyName) |
||||
if err == nil && sessionCloser != nil { |
||||
defer sessionCloser() |
||||
} |
||||
if euid != *uid { |
||||
// Switch users if required before starting the desired process.
|
||||
if err := syscall.Setuid(int(*uid)); err != nil { |
||||
logf(err.Error()) |
||||
os.Exit(1) |
||||
} |
||||
} |
||||
|
||||
var cArgs []string |
||||
if *cmdArgs != "" { |
||||
cArgs = strings.Split(*cmdArgs, " ") |
||||
} |
||||
|
||||
cmd := exec.Command(*cmdName, cArgs...) |
||||
cmd.Stdin = os.Stdin |
||||
cmd.Stdout = os.Stdout |
||||
cmd.Stderr = os.Stderr |
||||
cmd.Env = os.Environ() |
||||
|
||||
if *hasTTY { |
||||
// If we were launched with a tty then we should
|
||||
// mark that as the ctty of the child. However,
|
||||
// as the ctty is being passed from the parent
|
||||
// we set the child to foreground instead which
|
||||
// also passes the ctty.
|
||||
// However, we can not do this if never had a tty to
|
||||
// begin with.
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{ |
||||
Foreground: true, |
||||
} |
||||
} |
||||
return cmd.Run() |
||||
} |
||||
|
||||
// launchProcess launches an incubator process for the provided session.
|
||||
// It is responsible for configuring the process execution environment.
|
||||
// The caller can wait for the process to exit by calling cmd.Wait().
|
||||
func (srv *server) launchProcess(ctx context.Context, s ssh.Session, ci *sshConnInfo, lu *user.User) (cmd *exec.Cmd, stdin io.WriteCloser, stdout, stderr io.Reader, err error) { |
||||
shell := loginShell(lu.Uid) |
||||
var args []string |
||||
if rawCmd := s.RawCommand(); rawCmd != "" { |
||||
args = []string{"-c", rawCmd} |
||||
} |
||||
ptyReq, winCh, isPty := s.Pty() |
||||
|
||||
cmd = newIncubatorCommand(ctx, ci, lu, srv.tailscaledPath, shell, args) |
||||
cmd.Dir = lu.HomeDir |
||||
cmd.Env = append(cmd.Env, envForUser(lu)...) |
||||
cmd.Env = append(cmd.Env, s.Environ()...) |
||||
cmd.Env = append(cmd.Env, |
||||
fmt.Sprintf("SSH_CLIENT=%s %d %d", ci.src.IP(), ci.src.Port(), ci.dst.Port()), |
||||
fmt.Sprintf("SSH_CONNECTION=%s %d %s %d", ci.src.IP(), ci.src.Port(), ci.dst.IP(), ci.dst.Port()), |
||||
) |
||||
srv.logf("ssh: starting: %+v", cmd.Args) |
||||
|
||||
if !isPty { |
||||
stdin, stdout, stderr, err = startWithStdPipes(cmd) |
||||
return |
||||
} |
||||
pty, err := startWithPTY(cmd, ptyReq) |
||||
if err != nil { |
||||
return nil, nil, nil, nil, err |
||||
} |
||||
go resizeWindow(pty, winCh) |
||||
// When using a pty we don't get a separate reader for stderr.
|
||||
return cmd, pty, pty, nil, nil |
||||
} |
||||
|
||||
func resizeWindow(f *os.File, winCh <-chan ssh.Window) { |
||||
for win := range winCh { |
||||
unix.IoctlSetWinsize(int(f.Fd()), syscall.TIOCSWINSZ, &unix.Winsize{ |
||||
Row: uint16(win.Height), |
||||
Col: uint16(win.Width), |
||||
}) |
||||
} |
||||
} |
||||
|
||||
// startWithPTY starts cmd with a psuedo-terminal attached to Stdin, Stdout and Stderr.
|
||||
func startWithPTY(cmd *exec.Cmd, ptyReq ssh.Pty) (ptyFile *os.File, err error) { |
||||
var tty *os.File |
||||
ptyFile, tty, err = pty.Open() |
||||
if err != nil { |
||||
err = fmt.Errorf("pty.Open: %w", err) |
||||
return |
||||
} |
||||
defer func() { |
||||
if err != nil { |
||||
ptyFile.Close() |
||||
tty.Close() |
||||
} |
||||
}() |
||||
if err = pty.Setsize(ptyFile, &pty.Winsize{ |
||||
Rows: uint16(ptyReq.Window.Width), |
||||
Cols: uint16(ptyReq.Window.Height), |
||||
}); err != nil { |
||||
err = fmt.Errorf("pty.Setsize: %w", err) |
||||
return |
||||
} |
||||
cmd.SysProcAttr = &syscall.SysProcAttr{ |
||||
Setctty: true, |
||||
Setsid: true, |
||||
} |
||||
cmd.Args = append(cmd.Args, "--has-tty=true") |
||||
if ptyName, err := ptyName(ptyFile); err == nil { |
||||
cmd.Args = append(cmd.Args, "--tty-name="+ptyName) |
||||
} |
||||
if ptyReq.Term != "" { |
||||
cmd.Env = append(cmd.Env, fmt.Sprintf("TERM=%s", ptyReq.Term)) |
||||
} |
||||
cmd.Stdin = tty |
||||
cmd.Stdout = tty |
||||
cmd.Stderr = tty |
||||
|
||||
if err = cmd.Start(); err != nil { |
||||
return |
||||
} |
||||
return ptyFile, nil |
||||
} |
||||
|
||||
// startWithStdPipes starts cmd with os.Pipe for Stdin, Stdout and Stderr.
|
||||
func startWithStdPipes(cmd *exec.Cmd) (stdin io.WriteCloser, stdout, stderr io.ReadCloser, err error) { |
||||
defer func() { |
||||
if err != nil { |
||||
for _, c := range []io.Closer{stdin, stdout, stderr} { |
||||
if c != nil { |
||||
c.Close() |
||||
} |
||||
} |
||||
} |
||||
}() |
||||
stdin, err = cmd.StdinPipe() |
||||
if err != nil { |
||||
return |
||||
} |
||||
stdout, err = cmd.StdoutPipe() |
||||
if err != nil { |
||||
return |
||||
} |
||||
stderr, err = cmd.StderrPipe() |
||||
if err != nil { |
||||
return |
||||
} |
||||
err = cmd.Start() |
||||
return |
||||
} |
||||
|
||||
func loginShell(uid string) string { |
||||
switch runtime.GOOS { |
||||
case "linux": |
||||
out, _ := exec.Command("getent", "passwd", uid).Output() |
||||
// out is "root:x:0:0:root:/root:/bin/bash"
|
||||
f := strings.SplitN(string(out), ":", 10) |
||||
if len(f) > 6 { |
||||
return strings.TrimSpace(f[6]) // shell
|
||||
} |
||||
} |
||||
if e := os.Getenv("SHELL"); e != "" { |
||||
return e |
||||
} |
||||
return "/bin/bash" |
||||
} |
||||
|
||||
func envForUser(u *user.User) []string { |
||||
return []string{ |
||||
fmt.Sprintf("SHELL=" + loginShell(u.Uid)), |
||||
fmt.Sprintf("USER=" + u.Username), |
||||
fmt.Sprintf("HOME=" + u.HomeDir), |
||||
} |
||||
} |
||||
@ -0,0 +1,174 @@ |
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
//go:build linux
|
||||
// +build linux
|
||||
|
||||
package tailssh |
||||
|
||||
import ( |
||||
"context" |
||||
"fmt" |
||||
"os" |
||||
"syscall" |
||||
"time" |
||||
"unsafe" |
||||
|
||||
"github.com/godbus/dbus/v5" |
||||
"tailscale.com/types/logger" |
||||
) |
||||
|
||||
func init() { |
||||
ptyName = ptyNameLinux |
||||
maybeStartLoginSession = maybeStartLoginSessionLinux |
||||
} |
||||
|
||||
func ptyNameLinux(f *os.File) (string, error) { |
||||
var n uint32 |
||||
_, _, e := syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), syscall.TIOCGPTN, uintptr(unsafe.Pointer(&n))) |
||||
if e != 0 { |
||||
return "", e |
||||
} |
||||
return fmt.Sprintf("pts/%d", n), nil |
||||
} |
||||
|
||||
// callLogin1 invokes the provided method of the "login1" service over D-Bus.
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
func callLogin1(method string, flags dbus.Flags, args ...interface{}) (*dbus.Call, error) { |
||||
conn, err := dbus.SystemBus() |
||||
if err != nil { |
||||
// DBus probably not running.
|
||||
return nil, err |
||||
} |
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), time.Second) |
||||
defer cancel() |
||||
|
||||
name, objectPath := "org.freedesktop.login1", "/org/freedesktop/login1" |
||||
obj := conn.Object(name, dbus.ObjectPath(objectPath)) |
||||
call := obj.CallWithContext(ctx, method, flags, args...) |
||||
if call.Err != nil { |
||||
return nil, call.Err |
||||
} |
||||
return call, nil |
||||
} |
||||
|
||||
// createSessionArgs is a wrapper struct for the Login1.Manager.CreateSession args.
|
||||
// The CreateSession API arguments and response types are defined here:
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
type createSessionArgs struct { |
||||
uid uint32 // User ID being logged in.
|
||||
pid uint32 // Process ID for the session, 0 means current process.
|
||||
service string // Service creating the session.
|
||||
typ string // Type of login (oneof unspecified, tty, x11).
|
||||
class string // Type of session class (oneof user, greeter, lock-screen).
|
||||
desktop string // the desktop environment.
|
||||
seat string // the seat this session belongs to, empty otherwise.
|
||||
vtnr uint32 // the virtual terminal number of the session if there is any, 0 otherwise.
|
||||
tty string // the kernel TTY path of the session if this is a text login, empty otherwise.
|
||||
display string // the X11 display name if this is a graphical login, empty otherwise.
|
||||
remote bool // whether the session is remote.
|
||||
remoteUser string // the remote user if this is a remote session, empty otherwise.
|
||||
remoteHost string // the remote host if this is a remote session, empty otherwise.
|
||||
properties []struct { // This is unused and exists just to make the marshaling work
|
||||
S string |
||||
V dbus.Variant |
||||
} |
||||
} |
||||
|
||||
func (a createSessionArgs) args() []interface{} { |
||||
return []interface{}{ |
||||
a.uid, |
||||
a.pid, |
||||
a.service, |
||||
a.typ, |
||||
a.class, |
||||
a.desktop, |
||||
a.seat, |
||||
a.vtnr, |
||||
a.tty, |
||||
a.display, |
||||
a.remote, |
||||
a.remoteUser, |
||||
a.remoteHost, |
||||
a.properties, |
||||
} |
||||
} |
||||
|
||||
// createSessionResp is a wrapper struct for the Login1.Manager.CreateSession response.
|
||||
// The CreateSession API arguments and response types are defined here:
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
type createSessionResp struct { |
||||
sessionID string |
||||
objectPath dbus.ObjectPath |
||||
runtimePath string |
||||
fifoFD dbus.UnixFD |
||||
uid uint32 |
||||
seatID string |
||||
vtnr uint32 |
||||
existing bool // whether a new session was created.
|
||||
} |
||||
|
||||
// createSession creates a tty user login session for the provided uid.
|
||||
func createSession(uid uint32, remoteUser, remoteHost, tty string) (createSessionResp, error) { |
||||
a := createSessionArgs{ |
||||
uid: uid, |
||||
service: "tailscaled", |
||||
typ: "tty", |
||||
class: "user", |
||||
tty: tty, |
||||
remote: true, |
||||
remoteUser: remoteUser, |
||||
remoteHost: remoteHost, |
||||
} |
||||
|
||||
call, err := callLogin1("org.freedesktop.login1.Manager.CreateSession", 0, a.args()...) |
||||
if err != nil { |
||||
return createSessionResp{}, err |
||||
} |
||||
|
||||
return createSessionResp{ |
||||
sessionID: call.Body[0].(string), |
||||
objectPath: call.Body[1].(dbus.ObjectPath), |
||||
runtimePath: call.Body[2].(string), |
||||
fifoFD: call.Body[3].(dbus.UnixFD), |
||||
uid: call.Body[4].(uint32), |
||||
seatID: call.Body[5].(string), |
||||
vtnr: call.Body[6].(uint32), |
||||
existing: call.Body[7].(bool), |
||||
}, nil |
||||
} |
||||
|
||||
// releaseSession releases the session identified by sessionID.
|
||||
func releaseSession(sessionID string) error { |
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
_, err := callLogin1("org.freedesktop.login1.Manager.ReleaseSession", dbus.FlagNoReplyExpected, sessionID) |
||||
return err |
||||
} |
||||
|
||||
// maybeStartLoginSessionLinux is the linux implementation of maybeStartLoginSession.
|
||||
func maybeStartLoginSessionLinux(logf logger.Logf, uid uint32, localUser, remoteUser, remoteHost, tty string) (func() error, error) { |
||||
if os.Geteuid() != 0 { |
||||
return nil, nil |
||||
} |
||||
logf("starting session for user %d", uid) |
||||
// The only way we can actually start a new session is if we are
|
||||
// running outside one and are root, which is typically the case
|
||||
// for systemd managed tailscaled.
|
||||
resp, err := createSession(uint32(uid), remoteUser, remoteHost, tty) |
||||
if err != nil { |
||||
// TODO(maisem): figure out if we are running in a session.
|
||||
// We can look at the DBus GetSessionByPID API.
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
// For now best effort is fine.
|
||||
logf("ssh: failed to CreateSession for user %q (%d) %v", localUser, uid, err) |
||||
return nil, nil |
||||
} |
||||
if !resp.existing { |
||||
return func() error { |
||||
return releaseSession(resp.sessionID) |
||||
}, nil |
||||
} |
||||
return nil, nil |
||||
} |
||||
Loading…
Reference in new issue