Merge branch 'busybox' into merge

7 files changed, 695 insertions, 16 deletions

diff --git a/util-linux/fbset.c b/util-linux/fbset.c
index ac0082f70..09e96b763 100644
--- a/util-linux/fbset.c
+++ b/util-linux/fbset.c
@@ -248,12 +248,12 @@ static int read_mode_db(struct fb_var_screeninfo *base, const char *fn,
                 if (!p)
                         continue;
                 s = p + strlen(mode);
-                //bb_info_msg("CHECK[%s][%s][%d]", mode, p-1, *s);
+                //bb_error_msg("CHECK[%s][%s][%d]", mode, p-1, *s);
                 /* exact match? */
                 if (((!*s || isspace(*s)) && '"' != s[-1]) /* end-of-token */
                  || ('"' == *s && '"' == p[-1]) /* ends with " but starts with " too! */
                 ) {
-                        //bb_info_msg("FOUND[%s][%s][%s][%d]", token[1], p, mode, isspace(*s));
+                        //bb_error_msg("FOUND[%s][%s][%s][%d]", token[1], p, mode, isspace(*s));
                         break;
                 }
         }
@@ -264,9 +264,9 @@ static int read_mode_db(struct fb_var_screeninfo *base, const char *fn,
         while (config_read(parser, token, 2, 1, "# \t", PARSE_NORMAL)) {
                 int i;
 
-//bb_info_msg("???[%s][%s]", token[0], token[1]);
+//bb_error_msg("???[%s][%s]", token[0], token[1]);
                 if (strcmp(token[0], "endmode") == 0) {
-//bb_info_msg("OK[%s]", mode);
+//bb_error_msg("OK[%s]", mode);
                         return 1;
                 }
                 p = token[1];
@@ -294,7 +294,7 @@ static int read_mode_db(struct fb_var_screeninfo *base, const char *fn,
                                 base->yres_virtual = base_yres_virtual;
                                 base->bits_per_pixel = base_bits_per_pixel;
                         }
-//bb_info_msg("GEO[%s]", p);
+//bb_error_msg("GEO[%s]", p);
                         break;
                 case 1:
                         if (sizeof(int) == sizeof(base->xres)) {
@@ -321,13 +321,13 @@ static int read_mode_db(struct fb_var_screeninfo *base, const char *fn,
                                 base->hsync_len = base_hsync_len;
                                 base->vsync_len = base_vsync_len;
                         }
-//bb_info_msg("TIM[%s]", p);
+//bb_error_msg("TIM[%s]", p);
                         break;
                 case 2:
                 case 3: {
                         static const uint32_t syncs[] = {FB_VMODE_INTERLACED, FB_VMODE_DOUBLE};
                         ss(&base->vmode, syncs[i-2], p, "false");
-//bb_info_msg("VMODE[%s]", p);
+//bb_error_msg("VMODE[%s]", p);
                         break;
                 }
                 case 4:
@@ -335,12 +335,12 @@ static int read_mode_db(struct fb_var_screeninfo *base, const char *fn,
                 case 6: {
                         static const uint32_t syncs[] = {FB_SYNC_VERT_HIGH_ACT, FB_SYNC_HOR_HIGH_ACT, FB_SYNC_COMP_HIGH_ACT};
                         ss(&base->sync, syncs[i-4], p, "low");
-//bb_info_msg("SYNC[%s]", p);
+//bb_error_msg("SYNC[%s]", p);
                         break;
                 }
                 case 7:
                         ss(&base->sync, FB_SYNC_EXT, p, "false");
-//bb_info_msg("EXTSYNC[%s]", p);
+//bb_error_msg("EXTSYNC[%s]", p);
                         break;
                 case 8: {
                         int red_offset, red_length;
diff --git a/util-linux/minix.h b/util-linux/minix.h
index e0fbcf761..83ffe6da5 100644
--- a/util-linux/minix.h
+++ b/util-linux/minix.h
@@ -61,9 +61,14 @@ enum {
         MINIX_ROOT_INO          = 1,
         MINIX_BAD_INO           = 2,
 
+#undef  MINIX1_SUPER_MAGIC
         MINIX1_SUPER_MAGIC      = 0x137F,       /* original minix fs */
+#undef  MINIX1_SUPER_MAGIC2
         MINIX1_SUPER_MAGIC2     = 0x138F,       /* minix fs, 30 char names */
+/* bionic has this define */
+#undef  MINIX2_SUPER_MAGIC
         MINIX2_SUPER_MAGIC      = 0x2468,       /* minix V2 fs */
+#undef  MINIX2_SUPER_MAGIC2
         MINIX2_SUPER_MAGIC2     = 0x2478,       /* minix V2 fs, 30 char names */
         MINIX_VALID_FS          = 0x0001,       /* clean fs */
         MINIX_ERROR_FS          = 0x0002,       /* fs has errors */
diff --git a/util-linux/mkfs_ext2.c b/util-linux/mkfs_ext2.c
index 3258d7eee..f91a0b4bf 100644
--- a/util-linux/mkfs_ext2.c
+++ b/util-linux/mkfs_ext2.c
@@ -116,7 +116,7 @@ static void allocate(uint8_t *bitmap, uint32_t blocksize, uint32_t start, uint32
 {
         uint32_t i;
 
-//bb_info_msg("ALLOC: [%u][%u][%u]: [%u-%u]:=[%x],[%x]", blocksize, start, end, start/8, blocksize - end/8 - 1, (1 << (start & 7)) - 1, (uint8_t)(0xFF00 >> (end & 7)));
+//bb_error_msg("ALLOC: [%u][%u][%u]: [%u-%u]:=[%x],[%x]", blocksize, start, end, start/8, blocksize - end/8 - 1, (1 << (start & 7)) - 1, (uint8_t)(0xFF00 >> (end & 7)));
         memset(bitmap, 0, blocksize);
         i = start / 8;
         memset(bitmap, 0xFF, i);
@@ -151,7 +151,7 @@ static uint32_t has_super(uint32_t x)
 
 static void PUT(uint64_t off, void *buf, uint32_t size)
 {
-//      bb_info_msg("PUT[%llu]:[%u]", off, size);
+        //bb_error_msg("PUT[%llu]:[%u]", off, size);
         xlseek(fd, off, SEEK_SET);
         xwrite(fd, buf, size);
 }
@@ -412,7 +412,7 @@ int mkfs_ext2_main(int argc UNUSED_PARAM, char **argv)
                 // (a bit after 8M image size), but it works for two->three groups
                 // transition (at 16M).
                 if (remainder && (remainder < overhead + 50)) {
-//bb_info_msg("CHOP[%u]", remainder);
+//bb_error_msg("CHOP[%u]", remainder);
                         nblocks -= remainder;
                         goto retry;
                 }
@@ -568,7 +568,7 @@ int mkfs_ext2_main(int argc UNUSED_PARAM, char **argv)
                 free_blocks = (n < blocks_per_group ? n : blocks_per_group) - overhead;
 
                 // mark preallocated blocks as allocated
-//bb_info_msg("ALLOC: [%u][%u][%u]", blocksize, overhead, blocks_per_group - (free_blocks + overhead));
+//bb_error_msg("ALLOC: [%u][%u][%u]", blocksize, overhead, blocks_per_group - (free_blocks + overhead));
                 allocate(buf, blocksize,
                         // reserve "overhead" blocks
                         overhead,
@@ -647,7 +647,7 @@ int mkfs_ext2_main(int argc UNUSED_PARAM, char **argv)
         n = FETCH_LE32(inode->i_block[0]) + 1;
         for (i = 0; i < lost_and_found_blocks; ++i)
                 STORE_LE(inode->i_block[i], i + n); // use next block
-//bb_info_msg("LAST BLOCK USED[%u]", i + n);
+//bb_error_msg("LAST BLOCK USED[%u]", i + n);
         PUT(((uint64_t)FETCH_LE32(gd[0].bg_inode_table) * blocksize) + (EXT2_GOOD_OLD_FIRST_INO-1) * inodesize,
                                 buf, inodesize);
 
diff --git a/util-linux/mkfs_vfat.c b/util-linux/mkfs_vfat.c
index 7d81ed06d..d53c751eb 100644
--- a/util-linux/mkfs_vfat.c
+++ b/util-linux/mkfs_vfat.c
@@ -578,7 +578,7 @@ int mkfs_vfat_main(int argc UNUSED_PARAM, char **argv)
                 start_data_sector = (reserved_sect + NUM_FATS * sect_per_fat) * (bytes_per_sect / SECTOR_SIZE);
                 start_data_block = (start_data_sector + SECTORS_PER_BLOCK - 1) / SECTORS_PER_BLOCK;
 
-                bb_info_msg("searching for bad blocks ");
+                bb_error_msg("searching for bad blocks");
                 currently_testing = 0;
                 try = TEST_BUFFER_BLOCKS;
                 while (currently_testing < volume_size_blocks) {
@@ -616,7 +616,7 @@ int mkfs_vfat_main(int argc UNUSED_PARAM, char **argv)
                 }
                 free(blkbuf);
                 if (badblocks)
-                        bb_info_msg("%d bad block(s)", badblocks);
+                        bb_error_msg("%d bad block(s)", badblocks);
         }
 #endif
 
diff --git a/util-linux/nsenter.c b/util-linux/nsenter.c
new file mode 100644
index 000000000..b08b3dae7
--- /dev/null
+++ b/util-linux/nsenter.c
@@ -0,0 +1,291 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Mini nsenter implementation for busybox.
+ *
+ * Copyright (C) 2016 by Bartosz Golaszewski <bartekgola@gmail.com>
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+
+//config:config NSENTER
+//config:       bool "nsenter"
+//config:       default y
+//config:       select PLATFORM_LINUX
+//config:       help
+//config:         Run program with namespaces of other processes.
+//config:
+//config:config FEATURE_NSENTER_LONG_OPTS
+//config:       bool "Enable long options"
+//config:       default y
+//config:       depends on NSENTER && LONG_OPTS
+//config:       help
+//config:         Support long options for the nsenter applet. This makes
+//config:         the busybox implementation more compatible with upstream.
+
+//applet:IF_NSENTER(APPLET(nsenter, BB_DIR_USR_BIN, BB_SUID_DROP))
+
+//kbuild:lib-$(CONFIG_NSENTER) += nsenter.o
+
+//usage:#define nsenter_trivial_usage
+//usage:       "[OPTIONS] [PROG [ARGS]]"
+//usage:#if ENABLE_FEATURE_NSENTER_LONG_OPTS
+//usage:#define nsenter_full_usage "\n"
+//usage:     "\n        -t, --target=PID                Target process to get namespaces from"
+//usage:     "\n        -m, --mount[=FILE]              Enter mount namespace"
+//usage:     "\n        -u, --uts[=FILE]                Enter UTS namespace (hostname etc)"
+//usage:     "\n        -i, --ipc[=FILE]                Enter System V IPC namespace"
+//usage:     "\n        -n, --net[=FILE]                Enter network namespace"
+//usage:     "\n        -p, --pid[=FILE]                Enter pid namespace"
+//usage:     "\n        -U, --user[=FILE]               Enter user namespace"
+//usage:     "\n        -S, --setuid=UID                Set uid in entered namespace"
+//usage:     "\n        -G, --setgid=GID                Set gid in entered namespace"
+//usage:     "\n        --preserve-credentials          Don't touch uids or gids"
+//usage:     "\n        -r, --root[=DIR]                Set root directory"
+//usage:     "\n        -w, --wd[=DIR]                  Set working directory"
+//usage:     "\n        -F, --no-fork                   Don't fork before exec'ing PROG"
+//usage:#else
+//usage:#define nsenter_full_usage "\n"
+//usage:     "\n        -t PID          Target process to get namespaces from"
+//usage:     "\n        -m[FILE]        Enter mount namespace"
+//usage:     "\n        -u[FILE]        Enter UTS namespace (hostname etc)"
+//usage:     "\n        -i[FILE]        Enter System V IPC namespace"
+//usage:     "\n        -n[FILE]        Enter network namespace"
+//usage:     "\n        -p[FILE]        Enter pid namespace"
+//usage:     "\n        -U[FILE]        Enter user namespace"
+//usage:     "\n        -S UID          Set uid in entered namespace"
+//usage:     "\n        -G GID          Set gid in entered namespace"
+//usage:     "\n        -r[DIR]         Set root directory"
+//usage:     "\n        -w[DIR]         Set working directory"
+//usage:     "\n        -F              Don't fork before exec'ing PROG"
+//usage:#endif
+
+#include <sched.h>
+#ifndef CLONE_NEWUTS
+# define CLONE_NEWUTS  0x04000000
+#endif
+#ifndef CLONE_NEWIPC
+# define CLONE_NEWIPC  0x08000000
+#endif
+#ifndef CLONE_NEWUSER
+# define CLONE_NEWUSER 0x10000000
+#endif
+#ifndef CLONE_NEWPID
+# define CLONE_NEWPID  0x20000000
+#endif
+#ifndef CLONE_NEWNET
+# define CLONE_NEWNET  0x40000000
+#endif
+
+#include "libbb.h"
+
+struct namespace_descr {
+        int flag;               /* value passed to setns() */
+        char ns_nsfile8[8];     /* "ns/" + namespace file in process' procfs entry */
+};
+
+struct namespace_ctx {
+        char *path;             /* optional path to a custom ns file */
+        int fd;                 /* opened namespace file descriptor */
+};
+
+enum {
+        OPT_user        = 1 << 0,
+        OPT_ipc         = 1 << 1,
+        OPT_uts         = 1 << 2,
+        OPT_network     = 1 << 3,
+        OPT_pid         = 1 << 4,
+        OPT_mount       = 1 << 5,
+        OPT_target      = 1 << 6,
+        OPT_setuid      = 1 << 7,
+        OPT_setgid      = 1 << 8,
+        OPT_root        = 1 << 9,
+        OPT_wd          = 1 << 10,
+        OPT_nofork      = 1 << 11,
+        OPT_prescred    = (1 << 12) * ENABLE_FEATURE_NSENTER_LONG_OPTS,
+};
+enum {
+        NS_USR_POS = 0,
+        NS_IPC_POS,
+        NS_UTS_POS,
+        NS_NET_POS,
+        NS_PID_POS,
+        NS_MNT_POS,
+        NS_COUNT,
+};
+/*
+ * The order is significant in nsenter.
+ * The user namespace comes first, so that it is entered first.
+ * This gives an unprivileged user the potential to enter other namespaces.
+ */
+static const struct namespace_descr ns_list[] = {
+        { CLONE_NEWUSER, "ns/user", },
+        { CLONE_NEWIPC,  "ns/ipc",  },
+        { CLONE_NEWUTS,  "ns/uts",  },
+        { CLONE_NEWNET,  "ns/net",  },
+        { CLONE_NEWPID,  "ns/pid",  },
+        { CLONE_NEWNS,   "ns/mnt",  },
+};
+/*
+ * Upstream nsenter doesn't support the short option for --preserve-credentials
+ */
+static const char opt_str[] = "U::i::u::n::p::m::""t+S+G+r::w::F";
+
+#if ENABLE_FEATURE_NSENTER_LONG_OPTS
+static const char nsenter_longopts[] ALIGN1 =
+        "user\0"                        Optional_argument       "U"
+        "ipc\0"                         Optional_argument       "i"
+        "uts\0"                         Optional_argument       "u"
+        "network\0"                     Optional_argument       "n"
+        "pid\0"                         Optional_argument       "p"
+        "mount\0"                       Optional_argument       "m"
+        "target\0"                      Required_argument       "t"
+        "setuid\0"                      Required_argument       "S"
+        "setgid\0"                      Required_argument       "G"
+        "root\0"                        Optional_argument       "r"
+        "wd\0"                          Optional_argument       "w"
+        "no-fork\0"                     No_argument             "F"
+        "preserve-credentials\0"        No_argument             "\xff"
+        ;
+#endif
+
+/*
+ * Open a file and return the new descriptor. If a full path is provided in
+ * fs_path, then the file to which it points is opened. Otherwise (fd_path is
+ * NULL) the routine builds a path to a procfs file using the following
+ * template: '/proc/<target_pid>/<target_file>'.
+ */
+static int open_by_path_or_target(const char *path,
+                                  pid_t target_pid, const char *target_file)
+{
+        char proc_path_buf[sizeof("/proc/%u/1234567890") + sizeof(int)*3];
+
+        if (!path) {
+                if (target_pid == 0) {
+                        /* Example:
+                         * "nsenter -p PROG" - neither -pFILE nor -tPID given.
+                         */
+                        bb_show_usage();
+                }
+                snprintf(proc_path_buf, sizeof(proc_path_buf),
+                         "/proc/%u/%s", (unsigned)target_pid, target_file);
+                path = proc_path_buf;
+        }
+
+        return xopen(path, O_RDONLY);
+}
+
+int nsenter_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
+int nsenter_main(int argc UNUSED_PARAM, char **argv)
+{
+        int i;
+        unsigned int opts;
+        const char *root_dir_str = NULL;
+        const char *wd_str = NULL;
+        struct namespace_ctx ns_ctx_list[NS_COUNT];
+        int setgroups_failed;
+        int root_fd, wd_fd;
+        int target_pid = 0;
+        int uid = 0;
+        int gid = 0;
+
+        memset(ns_ctx_list, 0, sizeof(ns_ctx_list));
+
+        IF_FEATURE_NSENTER_LONG_OPTS(applet_long_options = nsenter_longopts);
+        opts = getopt32(argv, opt_str,
+                        &ns_ctx_list[NS_USR_POS].path,
+                        &ns_ctx_list[NS_IPC_POS].path,
+                        &ns_ctx_list[NS_UTS_POS].path,
+                        &ns_ctx_list[NS_NET_POS].path,
+                        &ns_ctx_list[NS_PID_POS].path,
+                        &ns_ctx_list[NS_MNT_POS].path,
+                        &target_pid, &uid, &gid,
+                        &root_dir_str, &wd_str
+        );
+        argv += optind;
+
+        root_fd = wd_fd = -1;
+        if (opts & OPT_root)
+                root_fd = open_by_path_or_target(root_dir_str,
+                                                 target_pid, "root");
+        if (opts & OPT_wd)
+                wd_fd = open_by_path_or_target(wd_str, target_pid, "cwd");
+
+        for (i = 0; i < NS_COUNT; i++) {
+                const struct namespace_descr *ns = &ns_list[i];
+                struct namespace_ctx *ns_ctx = &ns_ctx_list[i];
+
+                ns_ctx->fd = -1;
+                if (opts & (1 << i))
+                        ns_ctx->fd = open_by_path_or_target(ns_ctx->path,
+                                        target_pid, ns->ns_nsfile8);
+        }
+
+        /*
+         * Entering the user namespace without --preserve-credentials implies
+         * --setuid & --setgid and clearing root's groups.
+         */
+        setgroups_failed = 0;
+        if ((opts & OPT_user) && !(opts & OPT_prescred)) {
+                opts |= (OPT_setuid | OPT_setgid);
+                /*
+                 * We call setgroups() before and after setns() and only
+                 * bail-out if it fails twice.
+                 */
+                setgroups_failed = (setgroups(0, NULL) < 0);
+        }
+
+        for (i = 0; i < NS_COUNT; i++) {
+                const struct namespace_descr *ns = &ns_list[i];
+                struct namespace_ctx *ns_ctx = &ns_ctx_list[i];
+
+                if (ns_ctx->fd < 0)
+                        continue;
+                if (setns(ns_ctx->fd, ns->flag)) {
+                        bb_perror_msg_and_die(
+                                "setns(): can't reassociate to namespace '%s'",
+                                ns->ns_nsfile8 + 3 /* skip over "ns/" */
+                        );
+                }
+                close(ns_ctx->fd); /* should close fds, to not confuse exec'ed PROG */
+                /*ns_ctx->fd = -1;*/
+        }
+
+        if (root_fd >= 0) {
+                if (wd_fd < 0) {
+                        /*
+                         * Save the current working directory if we're not
+                         * changing it.
+                         */
+                        wd_fd = xopen(".", O_RDONLY);
+                }
+                xfchdir(root_fd);
+                xchroot(".");
+                close(root_fd);
+                /*root_fd = -1;*/
+        }
+
+        if (wd_fd >= 0) {
+                xfchdir(wd_fd);
+                close(wd_fd);
+                /*wd_fd = -1;*/
+        }
+
+        /*
+         * Entering the pid namespace implies forking unless it's been
+         * explicitly requested by the user not to.
+         */
+        if (!(opts & OPT_nofork) && (opts & OPT_pid)) {
+                xvfork_parent_waits_and_exits();
+                /* Child continues */
+        }
+
+        if (opts & OPT_setgid) {
+                if (setgroups(0, NULL) < 0 && setgroups_failed)
+                        bb_perror_msg_and_die("setgroups");
+                xsetgid(gid);
+        }
+        if (opts & OPT_setuid)
+                xsetuid(uid);
+
+        exec_prog_or_SHELL(argv);
+}
diff --git a/util-linux/umount.c b/util-linux/umount.c
index 00910977d..30bef1686 100644
--- a/util-linux/umount.c
+++ b/util-linux/umount.c
@@ -30,6 +30,9 @@
 
 #include <mntent.h>
 #include <sys/mount.h>
+#ifndef MNT_DETACH
+# define MNT_DETACH 0x00000002
+#endif
 #include "libbb.h"
 
 #if defined(__dietlibc__)
diff --git a/util-linux/unshare.c b/util-linux/unshare.c
new file mode 100644
index 000000000..d05cfdb6c
--- /dev/null
+++ b/util-linux/unshare.c
@@ -0,0 +1,380 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Mini unshare implementation for busybox.
+ *
+ * Copyright (C) 2016 by Bartosz Golaszewski <bartekgola@gmail.com>
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+
+//config:config UNSHARE
+//config:       bool "unshare"
+//config:       default y
+//config:       depends on LONG_OPTS && !NOMMU
+//config:       select PLATFORM_LINUX
+//config:       help
+//config:         Run program with some namespaces unshared from parent.
+
+// depends on LONG_OPTS: it is awkward to exclude code which handles --propagation
+// and --setgroups based on LONG_OPTS, so instead applet requires LONG_OPTS.
+// depends on !NOMMU: we need fork()
+
+//applet:IF_UNSHARE(APPLET(unshare, BB_DIR_USR_BIN, BB_SUID_DROP))
+
+//kbuild:lib-$(CONFIG_UNSHARE) += unshare.o
+
+//usage:#define unshare_trivial_usage
+//usage:       "[OPTIONS] [PROG [ARGS]]"
+//usage:#define unshare_full_usage "\n"
+//usage:     "\n        -m, --mount[=FILE]      Unshare mount namespace"
+//usage:     "\n        -u, --uts[=FILE]        Unshare UTS namespace (hostname etc.)"
+//usage:     "\n        -i, --ipc[=FILE]        Unshare System V IPC namespace"
+//usage:     "\n        -n, --net[=FILE]        Unshare network namespace"
+//usage:     "\n        -p, --pid[=FILE]        Unshare PID namespace"
+//usage:     "\n        -U, --user[=FILE}       Unshare user namespace"
+//usage:     "\n        -f, --fork              Fork before execing PROG"
+//usage:     "\n        -r, --map-root-user     Map current user to root (implies -u)"
+//usage:     "\n        --mount-proc[=DIR]      Mount /proc filesystem first (implies -m)"
+//usage:     "\n        --propagation slave|shared|private|unchanged"
+//usage:     "\n                                Modify mount propagation in mount namespace"
+//usage:     "\n        --setgroups allow|deny  Control the setgroups syscall in user namespaces"
+
+#include <sched.h>
+#ifndef CLONE_NEWUTS
+# define CLONE_NEWUTS  0x04000000
+#endif
+#ifndef CLONE_NEWIPC
+# define CLONE_NEWIPC  0x08000000
+#endif
+#ifndef CLONE_NEWUSER
+# define CLONE_NEWUSER 0x10000000
+#endif
+#ifndef CLONE_NEWPID
+# define CLONE_NEWPID  0x20000000
+#endif
+#ifndef CLONE_NEWNET
+# define CLONE_NEWNET  0x40000000
+#endif
+
+#include <sys/mount.h>
+#ifndef MS_REC
+# define MS_REC     (1 << 14)
+#endif
+#ifndef MS_PRIVATE
+# define MS_PRIVATE (1 << 18)
+#endif
+#ifndef MS_SLAVE
+# define MS_SLAVE   (1 << 19)
+#endif
+#ifndef MS_SHARED
+# define MS_SHARED  (1 << 20)
+#endif
+
+#include "libbb.h"
+
+static void mount_or_die(const char *source, const char *target,
+                 const char *fstype, unsigned long mountflags)
+{
+        if (mount(source, target, fstype, mountflags, NULL)) {
+                bb_perror_msg_and_die("can't mount %s on %s (flags:0x%lx)",
+                        source, target, mountflags);
+                /* fstype is always either NULL or "proc".
+                 * "proc" is only used to mount /proc.
+                 * No need to clutter up error message with fstype,
+                 * it is easily deductible.
+                 */
+        }
+}
+
+#define PATH_PROC_SETGROUPS     "/proc/self/setgroups"
+#define PATH_PROC_UIDMAP        "/proc/self/uid_map"
+#define PATH_PROC_GIDMAP        "/proc/self/gid_map"
+
+struct namespace_descr {
+        int flag;
+        const char nsfile4[4];
+};
+
+struct namespace_ctx {
+        char *path;
+};
+
+enum {
+        OPT_mount       = 1 << 0,
+        OPT_uts         = 1 << 1,
+        OPT_ipc         = 1 << 2,
+        OPT_network     = 1 << 3,
+        OPT_pid         = 1 << 4,
+        OPT_user        = 1 << 5, /* OPT_user, NS_USR_POS, and ns_list[] index must match! */
+        OPT_fork        = 1 << 6,
+        OPT_map_root    = 1 << 7,
+        OPT_mount_proc  = 1 << 8,
+        OPT_propagation = 1 << 9,
+        OPT_setgroups   = 1 << 10,
+};
+enum {
+        NS_MNT_POS = 0,
+        NS_UTS_POS,
+        NS_IPC_POS,
+        NS_NET_POS,
+        NS_PID_POS,
+        NS_USR_POS, /* OPT_user, NS_USR_POS, and ns_list[] index must match! */
+        NS_COUNT,
+};
+static const struct namespace_descr ns_list[] = {
+        { CLONE_NEWNS,   "mnt"  },
+        { CLONE_NEWUTS,  "uts"  },
+        { CLONE_NEWIPC,  "ipc"  },
+        { CLONE_NEWNET,  "net"  },
+        { CLONE_NEWPID,  "pid"  },
+        { CLONE_NEWUSER, "user" }, /* OPT_user, NS_USR_POS, and ns_list[] index must match! */
+};
+
+/*
+ * Upstream unshare doesn't support short options for --mount-proc,
+ * --propagation, --setgroups.
+ * Optional arguments (namespace mountpoints) exist only for long opts,
+ * we are forced to use "fake" letters for them.
+ * '+': stop at first non-option.
+ */
+static const char opt_str[] = "+muinpU""fr""\xfd::""\xfe:""\xff:";
+static const char unshare_longopts[] ALIGN1 =
+        "mount\0"               Optional_argument       "\xf0"
+        "uts\0"                 Optional_argument       "\xf1"
+        "ipc\0"                 Optional_argument       "\xf2"
+        "network\0"             Optional_argument       "\xf3"
+        "pid\0"                 Optional_argument       "\xf4"
+        "user\0"                Optional_argument       "\xf5"
+        "fork\0"                No_argument             "f"
+        "map-root-user\0"       No_argument             "r"
+        "mount-proc\0"          Optional_argument       "\xfd"
+        "propagation\0"         Required_argument       "\xfe"
+        "setgroups\0"           Required_argument       "\xff"
+;
+
+/* Ugly-looking string reuse trick */
+#define PRIVATE_STR   "private\0""unchanged\0""shared\0""slave\0"
+#define PRIVATE_UNCHANGED_SHARED_SLAVE   PRIVATE_STR
+
+static unsigned long parse_propagation(const char *prop_str)
+{
+        int i = index_in_strings(PRIVATE_UNCHANGED_SHARED_SLAVE, prop_str);
+        if (i < 0)
+                bb_error_msg_and_die("unrecognized: --%s=%s", "propagation", prop_str);
+        if (i == 0)
+                return MS_REC | MS_PRIVATE;
+        if (i == 1)
+                return 0;
+        if (i == 2)
+                return MS_REC | MS_SHARED;
+        return MS_REC | MS_SLAVE;
+}
+
+static void mount_namespaces(pid_t pid, struct namespace_ctx *ns_ctx_list)
+{
+        const struct namespace_descr *ns;
+        struct namespace_ctx *ns_ctx;
+        int i;
+
+        for (i = 0; i < NS_COUNT; i++) {
+                char nsf[sizeof("/proc/%u/ns/AAAA") + sizeof(int)*3];
+
+                ns = &ns_list[i];
+                ns_ctx = &ns_ctx_list[i];
+                if (!ns_ctx->path)
+                        continue;
+                sprintf(nsf, "/proc/%u/ns/%.4s", (unsigned)pid, ns->nsfile4);
+                mount_or_die(nsf, ns_ctx->path, NULL, MS_BIND);
+        }
+}
+
+int unshare_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
+int unshare_main(int argc UNUSED_PARAM, char **argv)
+{
+        int i;
+        unsigned int opts;
+        int unsflags;
+        uintptr_t need_mount;
+        const char *proc_mnt_target;
+        const char *prop_str;
+        const char *setgrp_str;
+        unsigned long prop_flags;
+        uid_t reuid = geteuid();
+        gid_t regid = getegid();
+        struct fd_pair fdp;
+        pid_t child = child; /* for compiler */
+        struct namespace_ctx ns_ctx_list[NS_COUNT];
+
+        memset(ns_ctx_list, 0, sizeof(ns_ctx_list));
+        proc_mnt_target = "/proc";
+        prop_str = PRIVATE_STR;
+        setgrp_str = NULL;
+
+        opt_complementary =
+                "\xf0""m" /* long opts (via their "fake chars") imply short opts */
+                ":\xf1""u"
+                ":\xf2""i"
+                ":\xf3""n"
+                ":\xf4""p"
+                ":\xf5""U"
+                ":ru"      /* --map-root-user or -r implies -u */
+                ":\xfd""m" /* --mount-proc implies -m */
+        ;
+        applet_long_options = unshare_longopts;
+        opts = getopt32(argv, opt_str,
+                        &proc_mnt_target, &prop_str, &setgrp_str,
+                        &ns_ctx_list[NS_MNT_POS].path,
+                        &ns_ctx_list[NS_UTS_POS].path,
+                        &ns_ctx_list[NS_IPC_POS].path,
+                        &ns_ctx_list[NS_NET_POS].path,
+                        &ns_ctx_list[NS_PID_POS].path,
+                        &ns_ctx_list[NS_USR_POS].path
+        );
+        argv += optind;
+        //bb_error_msg("opts:0x%x", opts);
+        //bb_error_msg("mount:%s", ns_ctx_list[NS_MNT_POS].path);
+        //bb_error_msg("proc_mnt_target:%s", proc_mnt_target);
+        //bb_error_msg("prop_str:%s", prop_str);
+        //bb_error_msg("setgrp_str:%s", setgrp_str);
+        //exit(1);
+
+        if (setgrp_str) {
+                if (strcmp(setgrp_str, "allow") == 0) {
+                        if (opts & OPT_map_root) {
+                                bb_error_msg_and_die(
+                                        "--setgroups=allow and --map-root-user "
+                                        "are mutually exclusive"
+                                );
+                        }
+                } else {
+                        /* It's not "allow", must be "deny" */
+                        if (strcmp(setgrp_str, "deny") != 0)
+                                bb_error_msg_and_die("unrecognized: --%s=%s",
+                                        "setgroups", setgrp_str);
+                }
+        }
+
+        unsflags = 0;
+        need_mount = 0;
+        for (i = 0; i < NS_COUNT; i++) {
+                const struct namespace_descr *ns = &ns_list[i];
+                struct namespace_ctx *ns_ctx = &ns_ctx_list[i];
+
+                if (opts & (1 << i))
+                        unsflags |= ns->flag;
+
+                need_mount |= (uintptr_t)(ns_ctx->path);
+        }
+        /* need_mount != 0 if at least one FILE was given */
+
+        prop_flags = MS_REC | MS_PRIVATE;
+        /* Silently ignore --propagation if --mount is not requested. */
+        if (opts & OPT_mount)
+                prop_flags = parse_propagation(prop_str);
+
+        /*
+         * Special case: if we were requested to unshare the mount namespace
+         * AND to make any namespace persistent (by bind mounting it) we need
+         * to spawn a child process which will wait for the parent to call
+         * unshare(), then mount parent's namespaces while still in the
+         * previous namespace.
+         */
+        fdp.wr = -1;
+        if (need_mount && (opts & OPT_mount)) {
+                /*
+                 * Can't use getppid() in child, as we can be unsharing the
+                 * pid namespace.
+                 */
+                pid_t ppid = getpid();
+
+                xpiped_pair(fdp);
+
+                child = xfork();
+                if (child == 0) {
+                        /* Child */
+                        close(fdp.wr);
+
+                        /* Wait until parent calls unshare() */
+                        read(fdp.rd, ns_ctx_list, 1); /* ...using bogus buffer */
+                        /*close(fdp.rd);*/
+
+                        /* Mount parent's unshared namespaces. */
+                        mount_namespaces(ppid, ns_ctx_list);
+                        return EXIT_SUCCESS;
+                }
+                /* Parent continues */
+        }
+
+        if (unshare(unsflags) != 0)
+                bb_perror_msg_and_die("unshare(0x%x)", unsflags);
+
+        if (fdp.wr >= 0) {
+                close(fdp.wr); /* Release child */
+                close(fdp.rd); /* should close fd, to not confuse exec'ed PROG */
+        }
+
+        if (need_mount) {
+                /* Wait for the child to finish mounting the namespaces. */
+                if (opts & OPT_mount) {
+                        int exit_status = wait_for_exitstatus(child);
+                        if (WIFEXITED(exit_status) &&
+                            WEXITSTATUS(exit_status) != EXIT_SUCCESS)
+                                return WEXITSTATUS(exit_status);
+                } else {
+                        /*
+                         * Regular way - we were requested to mount some other
+                         * namespaces: mount them after the call to unshare().
+                         */
+                        mount_namespaces(getpid(), ns_ctx_list);
+                }
+        }
+
+        /*
+         * When we're unsharing the pid namespace, it's not the process that
+         * calls unshare() that is put into the new namespace, but its first
+         * child. The user may want to use this option to spawn a new process
+         * that'll become PID 1 in this new namespace.
+         */
+        if (opts & OPT_fork) {
+                xvfork_parent_waits_and_exits();
+                /* Child continues */
+        }
+
+        if (opts & OPT_map_root) {
+                char uidmap_buf[sizeof("%u 0 1") + sizeof(int)*3];
+
+                /*
+                 * Since Linux 3.19 unprivileged writing of /proc/self/gid_map
+                 * has been disabled unless /proc/self/setgroups is written
+                 * first to permanently disable the ability to call setgroups
+                 * in that user namespace.
+                 */
+                xopen_xwrite_close(PATH_PROC_SETGROUPS, "deny");
+                sprintf(uidmap_buf, "%u 0 1", (unsigned)reuid);
+                xopen_xwrite_close(PATH_PROC_UIDMAP, uidmap_buf);
+                sprintf(uidmap_buf, "%u 0 1", (unsigned)regid);
+                xopen_xwrite_close(PATH_PROC_GIDMAP, uidmap_buf);
+        } else
+        if (setgrp_str) {
+                /* Write "allow" or "deny" */
+                xopen_xwrite_close(PATH_PROC_SETGROUPS, setgrp_str);
+        }
+
+        if (opts & OPT_mount) {
+                mount_or_die("none", "/", NULL, prop_flags);
+        }
+
+        if (opts & OPT_mount_proc) {
+                /*
+                 * When creating a new pid namespace, we might want the pid
+                 * subdirectories in /proc to remain consistent with the new
+                 * process IDs. Without --mount-proc the pids in /proc would
+                 * still reflect the old pid namespace. This is why we make
+                 * /proc private here and then do a fresh mount.
+                 */
+                mount_or_die("none", proc_mnt_target, NULL, MS_PRIVATE | MS_REC);
+                mount_or_die("proc", proc_mnt_target, "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV);
+        }
+
+        exec_prog_or_SHELL(argv);
+}