dnsmasq: add option to expose additional paths to jail

dangowrt · dangowrt · commit aa12a0fdd1c5 · 2022-11-27T14:06:08.000Z
Add new UCI list 'addn_mount' allowing the expose additional filesystem
paths to the jailed dnsmasq process. This is useful e.g. in case of
manually configured includes to the configuration file or symlinks
pointing outside of the exposed paths as used by e.g. the safe-search
package in the packages feed.

Signed-off-by: Daniel Golle &lt;daniel@makrotopia.org&gt;
diff --git a/package/network/services/dnsmasq/files/dhcp.conf b/package/network/services/dnsmasq/files/dhcp.conf
@@ -23,6 +23,7 @@ config dnsmasq
 	option ednspacket_max	1232
 	option filter_aaaa	0
 	option filter_a		0
+	#list addnmount		/some/path # read-only mount path to expose it to dnsmasq
 
 config dhcp lan
 	option interface	lan
diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init
@@ -204,8 +204,12 @@ ismounted() {
 	return 1
 }
 
-append_addnhosts() {
+append_extramount() {
 	ismounted "$1" || append EXTRA_MOUNT "$1"
+}
+
+append_addnhosts() {
+	append_extramount "$1"
 	xappend "--addn-hosts=$1"
 }
 
@@ -1186,6 +1190,8 @@ dnsmasq_start()
 		done
 	}
 
+	config_list_foreach "$cfg" addnmount append_extramount
+
 	procd_open_instance $cfg
 	procd_set_param command $PROG -C $CONFIGFILE -k -x /var/run/dnsmasq/dnsmasq."${cfg}".pid
 	procd_set_param file $CONFIGFILE

Original file line number	Diff line number	Diff line change
`@@ -204,8 +204,12 @@ ismounted() {`
`204`	`204`	`return 1`
`205`	`205`	`}`
`206`	`206`
`207`		`-append_addnhosts() {`
	`207`	`+append_extramount() {`
`208`	`208`	`ismounted "$1" \|\| append EXTRA_MOUNT "$1"`
	`209`	`+}`
	`210`	`+`
	`211`	`+append_addnhosts() {`
	`212`	`+ append_extramount "$1"`
`209`	`213`	`xappend "--addn-hosts=$1"`
`210`	`214`	`}`
`211`	`215`
`@@ -1186,6 +1190,8 @@ dnsmasq_start()`
`1186`	`1190`	`done`
`1187`	`1191`	`}`
`1188`	`1192`
	`1193`	`+ config_list_foreach "$cfg" addnmount append_extramount`
	`1194`	`+`
`1189`	`1195`	`procd_open_instance $cfg`
`1190`	`1196`	`procd_set_param command $PROG -C $CONFIGFILE -k -x /var/run/dnsmasq/dnsmasq."${cfg}".pid`
`1191`	`1197`	`procd_set_param file $CONFIGFILE`