Add ability to allow mount propagation for specific mounts

PiperOrigin-RevId: 781573464
Change-Id: I4fcd09e0f1063680fac8fd6f6801dfd898bbea6f

Author: happyCoder92

sandboxed_api/sandbox2/mount_tree.proto

@@ -34,6 +34,7 @@ message MountTree {
   message DirNode {
     string outside = 2;
     bool writable = 3;
+    bool allow_mount_propagation = 4;
   }
 
   // TmpfsNode mounts a tmpfs with given options.

sandboxed_api/sandbox2/mounts.cc

@@ -176,6 +176,21 @@ absl::Status Mounts::Remove(absl::string_view path) {
   return absl::OkStatus();
 }
 
+absl::StatusOr<MountTree::Node> Mounts::GetNode(absl::string_view path) {
+  std::vector<absl::string_view> parts =
+      absl::StrSplit(absl::StripPrefix(path, "/"), '/');
+  MountTree* curtree = &mount_tree_;
+  for (absl::string_view part : parts) {
+    auto it = curtree->mutable_entries()->find(std::string(part));
+    if (it == curtree->mutable_entries()->end()) {
+      return absl::NotFoundError(
+          absl::StrCat("Path does not exist in mounts: ", path));
+    }
+    curtree = &it->second;
+  }
+  return curtree->node();
+}
+
 absl::Status Mounts::Insert(absl::string_view path,
                             const MountTree::Node& new_node) {
   // Some sandboxes allow the inside/outside paths to be partially
@@ -353,6 +368,16 @@ absl::Status Mounts::AddTmpfs(absl::string_view inside, size_t sz) {
   return Insert(inside, node);
 }
 
+absl::Status Mounts::AllowMountPropagation(absl::string_view inside) {
+  SAPI_ASSIGN_OR_RETURN(MountTree::Node node, GetNode(inside));
+  if (!node.has_dir_node()) {
+    return absl::InvalidArgumentError(
+        absl::StrCat("Path is not a directory: ", inside));
+  }
+  node.mutable_dir_node()->set_allow_mount_propagation(true);
+  return absl::OkStatus();
+}
+
 namespace {
 
 uint64_t GetMountFlagsFor(const std::string& path) {
@@ -508,7 +533,8 @@ bool IsSymlink(const std::string& path) {
 
 // Traverses the MountTree to create all required files and perform the mounts.
 void CreateMounts(const MountTree& tree, const std::string& root_path,
-                  const std::string& path, bool create_backing_files) {
+                  const std::string& path, bool create_backing_files,
+                  bool allow_mount_propagation) {
   // First, create the backing files if needed.
   if (create_backing_files) {
     switch (tree.node().node_case()) {
@@ -549,8 +575,12 @@ void CreateMounts(const MountTree& tree, const std::string& root_path,
       create_backing_files = false;
 
       auto node = tree.node().dir_node();
-      MountWithDefaults(node.outside(), path, "", MS_BIND, nullptr,
-                        !node.writable());
+      MountWithDefaults(
+          node.outside(), path, "",
+          MS_BIND | (node.allow_mount_propagation() || allow_mount_propagation
+                         ? MS_SHARED
+                         : MS_PRIVATE),
+          nullptr, !node.writable());
       break;
     }
     case MountTree::Node::kTmpfsNode: {
@@ -580,14 +610,17 @@ void CreateMounts(const MountTree& tree, const std::string& root_path,
   // Traverse the subtrees.
   for (const auto& [key, value] : GetSortedEntries(tree)) {
     std::string new_path = sapi::file::JoinPath(path, key);
-    CreateMounts(*value, root_path, new_path, create_backing_files);
+    CreateMounts(*value, root_path, new_path, create_backing_files,
+                 allow_mount_propagation);
   }
 }
 
 }  // namespace
 
-void Mounts::CreateMounts(const std::string& root_path) const {
-  sandbox2::CreateMounts(mount_tree_, root_path, root_path, true);
+void Mounts::CreateMounts(const std::string& root_path,
+                          bool allow_mount_propagation) const {
+  sandbox2::CreateMounts(mount_tree_, root_path, root_path, true,
+                         allow_mount_propagation);
 }
 
 namespace {

sandboxed_api/sandbox2/mounts.h

@@ -71,9 +71,12 @@ class Mounts {
 
   absl::Status AddTmpfs(absl::string_view inside, size_t sz);
 
+  absl::Status AllowMountPropagation(absl::string_view inside);
+
   absl::Status Remove(absl::string_view path);
 
-  void CreateMounts(const std::string& root_path) const;
+  void CreateMounts(const std::string& root_path,
+                    bool allow_mount_propagation) const;
 
   MountTree GetMountTree() const { return mount_tree_; }
 
@@ -101,6 +104,7 @@ class Mounts {
  private:
   friend class MountTreeTest;
 
+  absl::StatusOr<MountTree::Node> GetNode(absl::string_view path);
   absl::Status Insert(absl::string_view path, const MountTree::Node& node);
 
   MountTree mount_tree_;

sandboxed_api/sandbox2/namespace.cc

@@ -64,7 +64,7 @@ int MountFallbackToReadOnly(const char* source, const char* target,
   return rv;
 }
 
-void PrepareChroot(const Mounts& mounts) {
+void PrepareChroot(const Mounts& mounts, bool allow_mount_propagation) {
   // Create a tmpfs mount for the new rootfs.
   SAPI_RAW_CHECK(
       file_util::fileops::CreateDirectoryRecursively(kSandbox2ChrootPath, 0700),
@@ -73,7 +73,7 @@ void PrepareChroot(const Mounts& mounts) {
                   "mounting rootfs failed");
 
   // Walk the tree and perform all the mount operations.
-  mounts.CreateMounts(kSandbox2ChrootPath);
+  mounts.CreateMounts(kSandbox2ChrootPath, allow_mount_propagation);
 
   if (mounts.IsRootReadOnly()) {
     // Remount the chroot read-only
@@ -258,7 +258,7 @@ void Namespace::InitializeNamespaces(uid_t uid, gid_t gid, int32_t clone_flags,
     ActivateLoopbackInterface();
   }
 
-  PrepareChroot(mounts);
+  PrepareChroot(mounts, allow_mount_propagation);
 
   if (avoid_pivot_root) {
     // Keep a reference to /proc/self as it might not be mounted later
@@ -325,14 +325,6 @@ void Namespace::InitializeNamespaces(uid_t uid, gid_t gid, int32_t clone_flags,
   SAPI_RAW_PCHECK(chdir("/") == 0,
                   "changing cwd after mntns initialization failed");
 
-  if (allow_mount_propagation) {
-    SAPI_RAW_PCHECK(mount("/", "/", "", MS_SLAVE | MS_REC, nullptr) == 0,
-                    "changing mount propagation to slave failed");
-  } else {
-    SAPI_RAW_PCHECK(mount("/", "/", "", MS_PRIVATE | MS_REC, nullptr) == 0,
-                    "changing mount propagation to private failed");
-  }
-
   if (SAPI_RAW_VLOG_IS_ON(2)) {
     SAPI_RAW_VLOG(2, "Dumping the sandboxee's filesystem:");
     LogFilesystem("/");

sandboxed_api/sandbox2/policybuilder.cc

@@ -1798,6 +1798,15 @@ PolicyBuilder& PolicyBuilder::Allow(MountPropagation) {
   return *this;
 }
 
+PolicyBuilder& PolicyBuilder::Allow(MountPropagation,
+                                    absl::string_view inside) {
+  if (absl::Status status = mounts_.AllowMountPropagation(inside);
+      !status.ok()) {
+    SetError(status);
+  }
+  return *this;
+}
+
 PolicyBuilder& PolicyBuilder::DangerAllowMountPropagation() {
   return Allow(MountPropagation());
 }

sandboxed_api/sandbox2/policybuilder.h

@@ -940,6 +940,9 @@ class PolicyBuilder final {
   ABSL_DEPRECATED("Use Allow(sandbox2::MapExec()) instead")
   PolicyBuilder& DangerAllowMountPropagation();
   PolicyBuilder& Allow(MountPropagation);
+  // Changes mounts propagation from MS_PRIVATE to MS_SHARED for a specific
+  // mount.
+  PolicyBuilder& Allow(MountPropagation, absl::string_view inside);
 
   // Allows connections to this IP.
   PolicyBuilder& AllowIPv4(const std::string& ip_and_mask, uint32_t port = 0);