MAJOR: startup: use chroot auto by default when available

3.4 implemented "chroot auto", "chroot /", unprivileged chroot and a
warning for super-user when chroot is not used. We were not doing it
for unprivileged users because this would have caused confusion with
configs triggering warnings only on certain OSes or environments.
Now's time to switch to automatic chroot attempt on startup whenever
deemed possible.

For this, we reuse the previous rules to decide to emit a warning when
a chroot is possible but not done, and instead of complaining that no
chroot is done, we just attempt it before emitting the warning only in
case of failure.

This is marked major because it may break some old rare configs that
were emitting the warning in 3.4 due to the lack of chroot, when the
user expected to access for example a UNIX socket at run time, or
using an external check. The fix remains easy (and is explained in
the warning), just use "chroot /".

The change aims at increasing the default security level for users by
default (i.e. with the least config settings), but it's not critical,
so feedback will determine if we keep it as-is, if we adjust it, or if
we revert it.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 8e3bc2dba62d24809325b5728f5bf0702f43dbf3..a08724842e40f8553d2d23eb2450af49427fa0e3 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -2130,12 +2130,13 @@ chroot { <jail dir> | auto }
   The resulting jail has no name in the filesystem and is empty and read-only,
   removing the need to prepare a dedicated jail directory.
 
-  When starting with superuser privileges, a warning will be displayed if no
-  chroot is used, in order to encourage users to always use the mechanism. If
-  for any reason there is a compelling reason not to use chroot (e.g. access to
-  a server via a UNIX socket with an unconvenient path), it remains possible to
-  silence the warning by adding an explicit "chroot /", which has the benefit
-  of being visible in a configuration.
+  When starting with sufficient privileges, haproxy will automatically apply
+  "chroot auto" if no "chroot" directive is used, i.e. it will isolate itself
+  in a chroot jail, and will emit a warning if it fails to do so. If there is
+  a compelling reason not to use chroot (e.g. access to a server via a UNIX
+  socket outside of the jail), it remains possible to silence the warning by
+  adding an explicit "chroot /", which has the benefit of being visible in a
+  configuration.
 
 close-spread-time <time>
   Define a time window during which idle connections and active connections

diff --git a/src/haproxy.c b/src/haproxy.c
index 8b9bb6637f3598df8055ff7c20e0effd63d0448c..d305d17c0fb94b276db18b151b3165880a4017f2 100644 (file)
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -3750,16 +3750,26 @@ int main(int argc, char **argv)
                int chroot_permitted = geteuid() == 0;
 
 #if defined(USE_PRCTL) && defined(PR_CAPBSET_READ) && defined(CAP_SYS_CHROOT)
-               chroot_permitted &= (prctl(PR_CAPBSET_READ, CAP_SYS_CHROOT, 0, 0, 0) == 1);
-#endif
-               if (chroot_permitted) {
+               int ret = prctl(PR_CAPBSET_READ, CAP_SYS_CHROOT, 0, 0, 0);
+               if (ret == 1)
+                       chroot_permitted = 1;
+               else if (ret == 0)
+                       chroot_permitted = 0;
+               /* errors mean prctl() not supported, so don't update the verdict */
+#endif
+               if (chroot_permitted && do_chroot(argv[0], "auto") != 0) {
                        ha_warning("[%s.main()] HAProxy was started as root without any 'chroot' "
-                                  "directive. A chroot limits filesystem access of an intruder "
-                                  "to a single, preferably empty, directory. It is strongly recommended "
-                                  "to enable this feature whenever possible (it's always possible when "
-                                  "starting as root), via 'chroot auto' in the global section. If you "
-                                  "think you have good reasons for running outside a chroot, explicitly "
-                                  "configure 'chroot /' to silence this warning.\n", argv[0]);
+                                  "directive, and an attempt at automatically chrooting failed, "
+                                  "so the haproxy process is not as protected as it could be. "
+                                  "Please report this event to developers with as many details as "
+                                  "possible about your execution environment so they can evaluate "
+                                  "if anything can be done to better support it. A chroot limits "
+                                  "filesystem access of an intruder to a single, preferably empty, "
+                                  "directory. It is strongly recommended to enable this feature "
+                                  "whenever possible (it's always possible when starting as root), "
+                                  "via 'chroot auto' in the global section. If you think you have "
+                                  "good reasons for running outside a chroot, explicitly configure "
+                                  "'chroot /' to silence this warning.\n", argv[0]);
                }
        }