Fun with jailed dnsmasq

For Developers
1
  1. Adding 'log-facility=/tmp/dnsmasq.log' to /etc/dnsmasq.conf will not work.
    Because /tmp/dnsmasq.log not allowed for jailed dnsmasq.
    Need to use 'option logfacility /tmp/dnsmasq.log' in /etc/config/dhcp, instead.
    OR to edit /etc/init.d/dnsmasq, as a brutal hack.
  2. kill -SIGUSR1 $(cat /var/run/dnsmasq/dnsmasq*.pid)
    is a reliable method to crash (read: STOP) my system.
    Because 'cat /var/run/dnsmasq/dnsmasq*.pid' shows me 1 ....
    I guess, this is a bug in the jailing of dnsmasq in /etc/init.d/dnsmasq:
    PID-file needs to be writable for jailed dnsmasq.

Suggestion for improvement: It might be a good idea, to implement user-configurable jail-options,
i.e. by provision of /etc/config/jail, and sections for each jailed process.
To allow additions to ro-acces, and rw-access, from jail.
OR, even better, to define all jail opts for the various processes in /etc/conf/jail, only, and not to hard-code in /etc/init.d.

2

The whole /var/run/dnsmasq/ directory is mounted read-write in the jail.

I guess it’s just that the jailed process can’t determine its own PID to write to the file?

Also see:

3

Can’t determine own PID correctly. Which would explain the “1” I can see as PID. Indicating a bug in ujail utility.

4

I guess it’s considered a feature:

5

… a feature. This is a joke. Documented functionality of “dnsmasq …-x /var/run/dnsmasq/dnsmasq.cfg01411c.pid” is to store dnsmasqs pid . Period. Now I see, there is option ‘ -P create PIDFILE’ available for ujail. MAY BE, this should be used in /etc/init.d/dnsmasq when jailing.

6

that is quite reasonable. usually directly editing default config files is not recommended, should modify the corresponding config file under /etc/config. there is a logic in the init script to handle logfile, the default config file /etc/dnsmasq.conf is not parsed, just added to jail as-is.

2 Likes
7

I have the same code done on a Cudy_TR1200. Which worked with 24.10.4. Most likely, because there was no jail. Porting code to Cudy_TR3000 does not work any more, because jailing, all of a sudden. With some surprises. Anyway, solution found. But some more fun:

  1. Implementing something like log-rotate with dnsmasq, using

PID=$(ps | grep -m 1 /usr/sbin/dnsmasq | cut -d' ' -f2)

kill -SIGUSR1 $PID
mv dnsmasq.log dnsmasq-"$DATE".log
#touch /tmp/dnsmasq.log ; does not work, either
#chown dnsmasq /tmp/dnsmasq.log; does not work, either
kill -SIGUSR2 $PID

does not work. (No new logfile created, or no data written into touched file) .Because change of /tmp/dnsmasq.log (because being closed/reopened by dnsmasq) not “recognized” by jail ?

(inotify?)

Needs /etc/init.d/dnsmasq restart, instead.

8

you should not treat dnsmasq service as a native dnsmasq app. it runs as a procd+ujail service not a native app, you should not directly poke with it but use the service dnsmasq command and modify the corresponding /etc/config/dhcp.

9

Thre are quite a few sensible dnsmasq options, not available in /etc/config/dhcp.

Quote: The configuration is done with help of the uci-configuration file: /etc/config/dhcp, but you can use this together with the file /etc/dnsmasq.conf.

It might be a good idea, to make this jailing optional. Will try to remove ujail.

10

true. but you are doing something totally different and it is not working as you expect … which will not as it is not working like that.

11

Hmm, I've always naively just done killall -s USR1 dnsmasq to get cache info, which doesn't seem very service-like. Is there an alternative offered somewhere in the service code? I can't find anything that looks promising in the init.d files...

12

All problems (bad pid, SIGUSR1, SIGUSR2) solved, after elimination of ujail. Saves some RAM, anyway :slight_smile: (BTW: Also KERNEL_NAMESPACES dropped).

13

yeah, and introduced a new attack vector. there is a reason why ujail is used. but feel free not using, it’s your router, your data after all.

14

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.