From 0e3220684c6184a2f70396d991200ae207a25377 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 4 Jan 2024 18:39:03 +0100 Subject: [PATCH] ssh-generator: add simple new generator --- man/kernel-command-line.xml | 12 + man/rules/meson.build | 1 + man/systemd-ssh-generator.xml | 141 +++++++++ man/systemd.system-credentials.xml | 11 + meson.build | 1 + src/ssh-generator/meson.build | 8 + src/ssh-generator/ssh-generator.c | 476 +++++++++++++++++++++++++++++ 7 files changed, 650 insertions(+) create mode 100644 man/systemd-ssh-generator.xml create mode 100644 src/ssh-generator/meson.build create mode 100644 src/ssh-generator/ssh-generator.c diff --git a/man/kernel-command-line.xml b/man/kernel-command-line.xml index 25ad770dcd..ded41ffc36 100644 --- a/man/kernel-command-line.xml +++ b/man/kernel-command-line.xml @@ -138,6 +138,18 @@ + + systemd.ssh_auto= + systemd.ssh_listen= + + These parameters are interpreted by + systemd-ssh-generator8 + and may be used to control SSH sockets the system shall be reachable on. + + + + + systemd.volatile= diff --git a/man/rules/meson.build b/man/rules/meson.build index 3592b862f7..84555df905 100644 --- a/man/rules/meson.build +++ b/man/rules/meson.build @@ -1054,6 +1054,7 @@ manpages = [ ['systemd-socket-activate', '1', [], ''], ['systemd-socket-proxyd', '8', [], ''], ['systemd-soft-reboot.service', '8', [], ''], + ['systemd-ssh-generator', '8', [], ''], ['systemd-stdio-bridge', '1', [], ''], ['systemd-storagetm.service', '8', ['systemd-storagetm'], 'ENABLE_STORAGETM'], ['systemd-stub', diff --git a/man/systemd-ssh-generator.xml b/man/systemd-ssh-generator.xml new file mode 100644 index 0000000000..04c3263c37 --- /dev/null +++ b/man/systemd-ssh-generator.xml @@ -0,0 +1,141 @@ + + + +%entities; +]> + + + + + systemd-ssh-generator + systemd + + + + systemd-ssh-generator + 8 + + + + systemd-ssh-generator + Generator for binding a socket-activated SSH server to local AV_VSOCK + and AF_UNIX sockets + + + + /usr/lib/systemd/system-generators/systemd-ssh-generator + + + + Description + + systemd-ssh-generator binds a socket-activated SSH server to local + AV_VSOCK and AF_UNIX sockets under certain conditions. It only + has an effect if the sshd8 binary is + installed. Specifically, it does the following: + + + If invoked in a VM with AF_VSOCK support, a socket-activated SSH + per-connection service is bound to AF_VSOCK port 22. + + If invoked in a container environment with a writable directory + /run/host/unix-export/ pre-mounted it binds SSH to an AF_UNIX + socket /run/host/unix-export/ssh. The assumption is that this directory is bind + mounted to the host side as well, and can be used to connect to the container from there. See Container Interface for more information about + this interface. + + A local AF_UNIX socket + /run/ssh-unix-local/socket is also bound, unconditionally. This may be used for + SSH communication from the host to itself, without involving networking, for example to traverse + security boundaries safely and with secure authentication. + + Additional AF_UNIX and AF_VSOCK sockets are + optionally bound, based on the systemd.ssh_listen= kernel command line option or the + ssh.listen system credential (see below). + + + See + systemd-ssh-proxy1 for + details on how to connect to these sockets via the ssh client. + + The generator will use a packaged sshd@.service service template file if one + exists, and otherwise generate a suitable service template file. + + systemd-ssh-generator implements + systemd.generator7. + + + + Kernel Command Line + + systemd-ssh-generator understands the following + kernel-command-line7 + parameters: + + + + systemd.ssh_auto= + + This option takes an optional boolean argument, and defaults to yes. If enabled, the + automatic binding to the AF_VSOCK and AF_UNIX sockets + listed above is done. If disable, this is not done, except for those explicitly requested via + systemd.ssh_listen= on the kernel command line or via the + ssh.listen system credential. + + + + + + systemd.ssh_listen= + + This option configures an additional socket to bind SSH to. It may be used multiple + times to bind multiple sockets. The syntax should follow the one of ListenStream=, + see + systemd.socket5 + for details. This functionality supports all socket families systemd supports, including + AF_INET and AF_INET6. + + + + + + + + Credentials + + systemd-ssh-generator supports the system credentials logic. The following + credentials are used when passed in: + + + + ssh.listen + + This credential should be a text file, with each line referencing one additional + socket to bind SSH to. The syntax should follow the one of ListenStream=, see + systemd.socket5 + for details. This functionality supports all socket families systemd supports, including + AF_INET and AF_INET6. + + + + + + + + See Also + + systemd1 + kernel-command-line7 + systemd.system-credentials7 + vsock7 + unix7 + ssh1 + sshd8 + + + diff --git a/man/systemd.system-credentials.xml b/man/systemd.system-credentials.xml index eb4c94c47f..c1c8e97f0c 100644 --- a/man/systemd.system-credentials.xml +++ b/man/systemd.system-credentials.xml @@ -217,6 +217,17 @@ + + ssh.listen + + May be used to configure SSH sockets the system shall be reachable on. See + systemd-ssh-generator8 + for details. + + + + + sysusers.extra diff --git a/meson.build b/meson.build index d2d255391d..9074f14069 100644 --- a/meson.build +++ b/meson.build @@ -2206,6 +2206,7 @@ subdir('src/shutdown') subdir('src/sleep') subdir('src/socket-activate') subdir('src/socket-proxy') +subdir('src/ssh-generator') subdir('src/stdio-bridge') subdir('src/sulogin-shell') subdir('src/sysctl') diff --git a/src/ssh-generator/meson.build b/src/ssh-generator/meson.build new file mode 100644 index 0000000000..d21a7a36d9 --- /dev/null +++ b/src/ssh-generator/meson.build @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +executables += [ + generator_template + { + 'name' : 'systemd-ssh-generator', + 'sources' : files('ssh-generator.c'), + }, +] diff --git a/src/ssh-generator/ssh-generator.c b/src/ssh-generator/ssh-generator.c new file mode 100644 index 0000000000..feb967be74 --- /dev/null +++ b/src/ssh-generator/ssh-generator.c @@ -0,0 +1,476 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ + +#include +#include +#include + +#include "creds-util.h" +#include "fd-util.h" +#include "fileio.h" +#include "generator.h" +#include "install.h" +#include "missing_socket.h" +#include "parse-util.h" +#include "path-util.h" +#include "proc-cmdline.h" +#include "socket-netlink.h" +#include "socket-util.h" +#include "special.h" +#include "virt.h" + +/* A small generator binding potentially five or more SSH sockets: + * + * 1. Listen on AF_VSOCK port 22 if we run in a VM with AF_VSOCK enabled + * 2. Listen on AF_UNIX socket /run/host/unix-export/ssh if we run in a container with /run/host/ support + * 3. Listen on AF_UNIX socket /run/ssh-unix-local/socket (always) + * 4. Listen on any socket specified via kernel command line option systemd.ssh_listen= + * 5. Similar, but from system credential ssh.listen + * + * The first two provide a nice way for hosts to connect to containers and VMs they invoke via the usual SSH + * logic, but without waiting for networking or suchlike. The third allows the same for local clients. */ + +static const char *arg_dest = NULL; +static bool arg_auto = true; +static char **arg_listen_extra = NULL; + +static int parse_proc_cmdline_item(const char *key, const char *value, void *data) { + int r; + + assert(key); + + if (proc_cmdline_key_streq(key, "systemd.ssh_auto")) { + r = value ? parse_boolean(value) : 1; + if (r < 0) + log_warning_errno(r, "Failed to parse systemd.ssh_auto switch \"%s\", ignoring: %m", value); + else + arg_auto = r; + + } else if (proc_cmdline_key_streq(key, "systemd.ssh_listen")) { + + if (proc_cmdline_value_missing(key, value)) + return 0; + + SocketAddress sa; + r = socket_address_parse(&sa, value); + if (r < 0) + log_warning_errno(r, "Failed to parse systemd.ssh_listen= expression, ignoring: %s", value); + else { + _cleanup_free_ char *s = NULL; + r = socket_address_print(&sa, &s); + if (r < 0) + return log_error_errno(r, "Failed to format socket address: %m"); + + if (strv_consume(&arg_listen_extra, TAKE_PTR(s)) < 0) + return log_oom(); + } + } + + return 0; +} + +static int make_sshd_template_unit( + const char *dest, + const char *template, + const char *sshd_binary, + const char *found_sshd_template_service, + char **generated_sshd_template_unit) { + + int r; + + assert(dest); + assert(template); + assert(sshd_binary); + assert(generated_sshd_template_unit); + + /* If the system has a suitable template already, symlink it to the name we want to reuse it */ + if (found_sshd_template_service) + return generator_add_symlink( + dest, + template, + /* dep_type= */ NULL, + found_sshd_template_service); + + if (!*generated_sshd_template_unit) { + _cleanup_fclose_ FILE *f = NULL; + + r = generator_open_unit_file_full( + dest, + /* source= */ NULL, + "sshd-generated@.service", /* Give this generated unit a generic name, since we want to use it for both AF_UNIX and AF_VSOCK */ + &f, + generated_sshd_template_unit, + /* ret_temp_path= */ NULL); + if (r < 0) + return r; + + fprintf(f, + "[Unit]\n" + "Description=OpenSSH Per-Connection Server Daemon\n" + "Documentation=man:systemd-ssh-generator(8) man:sshd(8)\n" + "[Service]\n" + "ExecStart=-%s -i\n" + "StandardInput=socket", + sshd_binary); + + r = fflush_and_check(f); + if (r < 0) + return log_error_errno(r, "Failed to write sshd template: %m"); + } + + return generator_add_symlink( + dest, + template, + /* dep_type= */ NULL, + *generated_sshd_template_unit); +} + +static int write_socket_unit( + const char *dest, + const char *unit, + const char *listen_stream, + const char *comment) { + + int r; + + assert(dest); + assert(unit); + assert(listen_stream); + assert(comment); + + _cleanup_fclose_ FILE *f = NULL; + r = generator_open_unit_file( + dest, + /* source= */ NULL, + unit, + &f); + if (r < 0) + return r; + + fprintf(f, + "[Unit]\n" + "Description=OpenSSH Server Socket (systemd-ssh-generator, %s)\n" + "Documentation=man:systemd-ssh-generator(8)\n" + "\n[Socket]\n" + "ListenStream=%s\n" + "Accept=yes\n" + "PollLimitIntervalSec=30s\n" + "PollLimitBurst=50\n", + comment, + listen_stream); + + r = fflush_and_check(f); + if (r < 0) + return log_error_errno(r, "Failed to write %s SSH socket unit: %m", comment); + + r = generator_add_symlink( + dest, + SPECIAL_SOCKETS_TARGET, + "wants", + unit); + if (r < 0) + return r; + + return 0; +} + +static int add_vsock_socket( + const char *dest, + const char *sshd_binary, + const char *found_sshd_template_unit, + char **generated_sshd_template_unit) { + + int r; + + assert(dest); + assert(generated_sshd_template_unit); + + Virtualization v = detect_vm(); + if (v < 0) + return log_error_errno(v, "Failed to detect if we run in a VM: %m"); + if (v == VIRTUALIZATION_NONE) { + log_debug("Not running in a VM, not listening on AF_VSOCK."); + return 0; + } + + _cleanup_close_ int vsock_fd = socket(AF_VSOCK, SOCK_STREAM|SOCK_CLOEXEC, 0); + if (vsock_fd < 0) { + if (ERRNO_IS_NOT_SUPPORTED(errno)) { + log_debug("Not creating AF_VSOCK ssh listener, since AF_VSOCK is not available."); + return 0; + } + + return log_error_errno(errno, "Unable to test if AF_VSOCK is available: %m"); + } + + vsock_fd = safe_close(vsock_fd); + + /* Determine the local CID so that we can log it to help users to connect to this VM */ + unsigned local_cid; + r = vsock_get_local_cid(&local_cid); + if (r < 0) + return log_error_errno(r, "Failed to query local AF_VSOCK CID: %m"); + + r = make_sshd_template_unit( + dest, + "sshd-vsock@.service", + sshd_binary, + found_sshd_template_unit, + generated_sshd_template_unit); + if (r < 0) + return r; + + r = write_socket_unit( + dest, + "sshd-vsock.socket", + "vsock::22", + "AF_VSOCK"); + if (r < 0) + return r; + + log_info("Binding SSH to AF_VSOCK vsock::22.\n" + "→ connect via 'ssh vsock/%u' from host", local_cid); + return 0; +} + +static int add_local_unix_socket( + const char *dest, + const char *sshd_binary, + const char *found_sshd_template_unit, + char **generated_sshd_template_unit) { + + int r; + + assert(dest); + assert(sshd_binary); + assert(generated_sshd_template_unit); + + r = make_sshd_template_unit( + dest, + "sshd-unix-local@.service", + sshd_binary, + found_sshd_template_unit, + generated_sshd_template_unit); + if (r < 0) + return r; + + r = write_socket_unit( + dest, + "sshd-unix-local.socket", + "/run/ssh-unix-local/socket", + "AF_UNIX Local"); + if (r < 0) + return r; + + + log_info("Binding SSH to AF_UNIX socket /run/ssh-unix-local/socket.\n" + "→ connect via 'ssh .host' locally"); + return 0; +} + +static int add_export_unix_socket( + const char *dest, + const char *sshd_binary, + const char *found_sshd_template_unit, + char **generated_sshd_template_unit) { + + int r; + + assert(dest); + assert(sshd_binary); + assert(generated_sshd_template_unit); + + Virtualization v = detect_container(); + if (v < 0) + return log_error_errno(v, "Failed to detect if we run in a container: %m"); + if (v == VIRTUALIZATION_NONE) { + log_debug("Not running in container, not listening on /run/host/unix-export/ssh"); + return 0; + } + + if (access("/run/host/unix-export/", W_OK) < 0) { + if (errno == ENOENT) { + log_debug("Container manager does not provide /run/host/unix-export/ mount, not binding AF_UNIX socket there."); + return 0; + } + if (errno == EROFS || ERRNO_IS_PRIVILEGE(errno)) { + log_debug("Container manager does not provide write access to /run/host/unix-export/, not binding AF_UNIX socket there."); + return 0; + } + + return log_debug_errno(errno, "Unable to check if /run/host/unix-export exists: %m"); + } + + r = make_sshd_template_unit( + dest, + "sshd-unix-export@.service", + sshd_binary, + found_sshd_template_unit, + generated_sshd_template_unit); + if (r < 0) + return r; + + r = write_socket_unit( + dest, + "sshd-unix-export.socket", + "/run/host/unix-export/ssh", + "AF_UNIX Export"); + if (r < 0) + return r; + + log_info("Binding SSH to AF_UNIX socket /run/host/unix-export/ssh\n" + "→ connect via 'ssh unix/run/systemd/nspawn/unix-export/\?\?\?/ssh' from host"); + + return 0; +} + +static int add_extra_sockets( + const char *dest, + const char *sshd_binary, + const char *found_sshd_template_unit, + char **generated_sshd_template_unit) { + + unsigned n = 1; + int r; + + assert(dest); + assert(sshd_binary); + assert(generated_sshd_template_unit); + + if (strv_isempty(arg_listen_extra)) + return 0; + + STRV_FOREACH(i, arg_listen_extra) { + _cleanup_free_ char *service = NULL, *socket = NULL; + + if (n > 1) { + if (asprintf(&service, "sshd-extra-%u@.service", n) < 0) + return log_oom(); + + if (asprintf(&socket, "sshd-extra-%u.socket", n) < 0) + return log_oom(); + } + + r = make_sshd_template_unit( + dest, + service ?: "sshd-extra@.service", + sshd_binary, + found_sshd_template_unit, + generated_sshd_template_unit); + if (r < 0) + return r; + + r = write_socket_unit( + dest, + socket ?: "sshd-extra.socket", + *i, + *i); + if (r < 0) + return r; + + log_info("Binding SSH to socket %s.", *i); + n++; + } + + return 0; +} + +static int parse_credentials(void) { + _cleanup_free_ char *b = NULL; + size_t sz = 0; + int r; + + r = read_credential_with_decryption("ssh.listen", (void*) &b, &sz); + if (r < 0) + return r; + if (r == 0) + return 0; + + _cleanup_fclose_ FILE *f = NULL; + f = fmemopen_unlocked(b, sz, "r"); + if (!f) + return log_oom(); + + for (;;) { + _cleanup_free_ char *item = NULL; + + r = read_stripped_line(f, LINE_MAX, &item); + if (r == 0) + break; + if (r < 0) { + log_error_errno(r, "Failed to parse credential 'ssh.listen': %m"); + break; + } + + if (startswith(item, "#")) + continue; + + SocketAddress sa; + r = socket_address_parse(&sa, item); + if (r < 0) { + log_warning_errno(r, "Failed to parse systemd.ssh_listen= expression, ignoring: %s", item); + continue; + } + + _cleanup_free_ char *s = NULL; + r = socket_address_print(&sa, &s); + if (r < 0) + return log_error_errno(r, "Failed to format socket address: %m"); + + if (strv_consume(&arg_listen_extra, TAKE_PTR(s)) < 0) + return log_oom(); + } + + return 0; +} + +static int run(const char *dest, const char *dest_early, const char *dest_late) { + int r; + + assert_se(arg_dest = dest); + + r = proc_cmdline_parse(parse_proc_cmdline_item, /* userdata= */ NULL, /* flags= */ 0); + if (r < 0) + log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m"); + + (void) parse_credentials(); + + strv_sort(arg_listen_extra); + strv_uniq(arg_listen_extra); + + if (!arg_auto && strv_isempty(arg_listen_extra)) { + log_debug("Disabling SSH generator logic, because as it has been turned off explicitly."); + return 0; + } + + _cleanup_free_ char *sshd_binary = NULL; + r = find_executable("sshd", &sshd_binary); + if (r == -ENOENT) { + log_info("Disabling SSH generator logic, since sshd is not installed."); + return 0; + } + if (r < 0) + return log_error_errno(r, "Failed to determine if sshd is installed: %m"); + + _cleanup_(lookup_paths_free) LookupPaths lp = {}; + r = lookup_paths_init_or_warn(&lp, RUNTIME_SCOPE_SYSTEM, LOOKUP_PATHS_EXCLUDE_GENERATED, /* root_dir= */ NULL); + if (r < 0) + return r; + + _cleanup_free_ char *found_sshd_template_unit = NULL; + r = unit_file_exists_full(RUNTIME_SCOPE_SYSTEM, &lp, "sshd@.service", &found_sshd_template_unit); + if (r < 0) + return log_error_errno(r, "Unable to detect if sshd@.service exists: %m"); + + _cleanup_free_ char *generated_sshd_template_unit = NULL; + RET_GATHER(r, add_extra_sockets(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit)); + + if (arg_auto) { + RET_GATHER(r, add_vsock_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit)); + RET_GATHER(r, add_local_unix_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit)); + RET_GATHER(r, add_export_unix_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit)); + } + + return r; +} + +DEFINE_MAIN_GENERATOR_FUNCTION(run);