| 1 |
/* |
| 2 |
** Path sandbox for the gentoo linux portage package system, initially |
| 3 |
** based on the ROCK Linux Wrapper for getting a list of created files |
| 4 |
** |
| 5 |
** to integrate with bash, bash should have been built like this |
| 6 |
** |
| 7 |
** ./configure --prefix=<prefix> --host=<host> --without-gnu-malloc |
| 8 |
** |
| 9 |
** it's very important that the --enable-static-link option is NOT specified |
| 10 |
** |
| 11 |
** Copyright (C) 2001 Geert Bevin, Uwyn, http://www.uwyn.com |
| 12 |
** Distributed under the terms of the GNU General Public License, v2 or later |
| 13 |
** Author : Geert Bevin <gbevin@uwyn.com> |
| 14 |
** $Header$ |
| 15 |
*/ |
| 16 |
|
| 17 |
/* #define _GNU_SOURCE */ |
| 18 |
|
| 19 |
#include <errno.h> |
| 20 |
#include <signal.h> |
| 21 |
#include <stdio.h> |
| 22 |
#include <stdlib.h> |
| 23 |
#include <limits.h> |
| 24 |
#include <string.h> |
| 25 |
#include <sys/wait.h> |
| 26 |
#include <signal.h> |
| 27 |
#include <unistd.h> |
| 28 |
#include <fcntl.h> |
| 29 |
|
| 30 |
#include "sandbox.h" |
| 31 |
|
| 32 |
struct sandbox_info_t { |
| 33 |
char sandbox_log[SB_PATH_MAX]; |
| 34 |
char sandbox_debug_log[SB_PATH_MAX]; |
| 35 |
char sandbox_lib[SB_PATH_MAX]; |
| 36 |
char sandbox_rc[SB_PATH_MAX]; |
| 37 |
char work_dir[SB_PATH_MAX]; |
| 38 |
char var_tmp_dir[SB_PATH_MAX]; |
| 39 |
char tmp_dir[SB_PATH_MAX]; |
| 40 |
char *home_dir; |
| 41 |
} sandbox_info_t; |
| 42 |
|
| 43 |
static int print_debug = 0; |
| 44 |
static int stop_called = 0; |
| 45 |
|
| 46 |
volatile static pid_t child_pid = 0; |
| 47 |
|
| 48 |
extern char **environ; |
| 49 |
|
| 50 |
int sandbox_setup(struct sandbox_info_t *sandbox_info) |
| 51 |
{ |
| 52 |
if (NULL != getenv(ENV_PORTAGE_TMPDIR)) { |
| 53 |
/* Portage handle setting SANDBOX_WRITE itself. */ |
| 54 |
sandbox_info->work_dir[0] = '\0'; |
| 55 |
} else { |
| 56 |
if (NULL == getcwd(sandbox_info->work_dir, SB_PATH_MAX)) { |
| 57 |
perror("sandbox: Failed to get current directory"); |
| 58 |
return -1; |
| 59 |
} |
| 60 |
} |
| 61 |
|
| 62 |
/* Do not resolve symlinks, etc .. libsandbox will handle that. */ |
| 63 |
if (1 != is_dir(VAR_TMPDIR, 1)) { |
| 64 |
perror("sandbox: Failed to get var_tmp_dir"); |
| 65 |
return -1; |
| 66 |
} |
| 67 |
snprintf(sandbox_info->var_tmp_dir, SB_PATH_MAX, "%s", VAR_TMPDIR); |
| 68 |
|
| 69 |
if (-1 == get_tmp_dir(sandbox_info->tmp_dir)) { |
| 70 |
perror("sandbox: Failed to get tmp_dir"); |
| 71 |
return -1; |
| 72 |
} |
| 73 |
setenv(ENV_TMPDIR, sandbox_info->tmp_dir, 1); |
| 74 |
|
| 75 |
sandbox_info->home_dir = getenv("HOME"); |
| 76 |
if (!sandbox_info->home_dir) { |
| 77 |
sandbox_info->home_dir = sandbox_info->tmp_dir; |
| 78 |
setenv("HOME", sandbox_info->home_dir, 1); |
| 79 |
} |
| 80 |
|
| 81 |
/* Generate sandbox lib path */ |
| 82 |
get_sandbox_lib(sandbox_info->sandbox_lib); |
| 83 |
|
| 84 |
/* Generate sandbox bashrc path */ |
| 85 |
get_sandbox_rc(sandbox_info->sandbox_rc); |
| 86 |
|
| 87 |
/* Generate sandbox log full path */ |
| 88 |
get_sandbox_log(sandbox_info->sandbox_log); |
| 89 |
if (1 == exists(sandbox_info->sandbox_log)) { |
| 90 |
if (-1 == unlink(sandbox_info->sandbox_log)) { |
| 91 |
perror("sandbox: Could not unlink old log file"); |
| 92 |
return -1; |
| 93 |
} |
| 94 |
} |
| 95 |
|
| 96 |
/* Generate sandbox debug log full path */ |
| 97 |
get_sandbox_debug_log(sandbox_info->sandbox_debug_log); |
| 98 |
if (1 == exists(sandbox_info->sandbox_debug_log)) { |
| 99 |
if (-1 == unlink(sandbox_info->sandbox_debug_log)) { |
| 100 |
perror("sandbox: Could not unlink old debug log file"); |
| 101 |
return -1; |
| 102 |
} |
| 103 |
} |
| 104 |
|
| 105 |
return 0; |
| 106 |
} |
| 107 |
|
| 108 |
int print_sandbox_log(char *sandbox_log) |
| 109 |
{ |
| 110 |
int sandbox_log_file = -1; |
| 111 |
char *beep_count_env = NULL; |
| 112 |
int i, color, beep_count = 0; |
| 113 |
long len = 0; |
| 114 |
char *buffer = NULL; |
| 115 |
|
| 116 |
if (1 != is_file(sandbox_log)) { |
| 117 |
perror("sandbox: Log file is not a regular file"); |
| 118 |
return 0; |
| 119 |
} |
| 120 |
|
| 121 |
sandbox_log_file = open(sandbox_log, O_RDONLY); |
| 122 |
if (-1 == sandbox_log_file) { |
| 123 |
perror("sandbox: Could not open Log file"); |
| 124 |
return 0; |
| 125 |
} |
| 126 |
|
| 127 |
len = file_length(sandbox_log_file); |
| 128 |
buffer = (char *)malloc((len + 1) * sizeof(char)); |
| 129 |
memset(buffer, 0, len + 1); |
| 130 |
read(sandbox_log_file, buffer, len); |
| 131 |
close(sandbox_log_file); |
| 132 |
|
| 133 |
color = ((is_env_on(ENV_NOCOLOR)) ? 0 : 1); |
| 134 |
|
| 135 |
EERROR(color, |
| 136 |
"--------------------------- ACCESS VIOLATION SUMMARY ---------------------------", |
| 137 |
"\n"); |
| 138 |
EERROR(color, "LOG FILE = \"%s\"", "\n\n", sandbox_log); |
| 139 |
fprintf(stderr, "%s", buffer); |
| 140 |
if (NULL != buffer) |
| 141 |
free(buffer); |
| 142 |
EERROR(color, |
| 143 |
"--------------------------------------------------------------------------------", |
| 144 |
"\n"); |
| 145 |
|
| 146 |
beep_count_env = getenv(ENV_SANDBOX_BEEP); |
| 147 |
if (beep_count_env) |
| 148 |
beep_count = atoi(beep_count_env); |
| 149 |
else |
| 150 |
beep_count = DEFAULT_BEEP_COUNT; |
| 151 |
|
| 152 |
for (i = 0; i < beep_count; i++) { |
| 153 |
fputc('\a', stderr); |
| 154 |
if (i < beep_count - 1) |
| 155 |
sleep(1); |
| 156 |
} |
| 157 |
|
| 158 |
return 1; |
| 159 |
} |
| 160 |
|
| 161 |
void stop(int signum) |
| 162 |
{ |
| 163 |
if (stop_called == 0) { |
| 164 |
stop_called = 1; |
| 165 |
printf("sandbox: Caught signal %d in pid %d\n", |
| 166 |
signum, getpid()); |
| 167 |
|
| 168 |
if ((SIGUSR1 == signum) && (0 != child_pid)) |
| 169 |
kill(child_pid, SIGKILL); |
| 170 |
} else { |
| 171 |
fprintf(stderr, |
| 172 |
"sandbox: Signal already caught and busy still cleaning up!\n"); |
| 173 |
} |
| 174 |
} |
| 175 |
|
| 176 |
int get_sandbox_write_envvar(char *buf, struct sandbox_info_t *sandbox_info) |
| 177 |
{ |
| 178 |
int retval = 0; |
| 179 |
|
| 180 |
/* bzero out entire buffer then append trailing 0 */ |
| 181 |
memset(buf, 0, SB_BUF_LEN); |
| 182 |
|
| 183 |
/* these could go into make.globals later on */ |
| 184 |
retval = snprintf(buf, SB_BUF_LEN, |
| 185 |
"%s:%s/.gconfd/lock:%s/.bash_history:%s:%s:%s:%s", |
| 186 |
"/dev/zero:/dev/null:/dev/fd:/proc/self/fd:/dev/pts/:" |
| 187 |
"/dev/vc/:/dev/pty:/dev/tty:/dev/tts:/dev/console:" |
| 188 |
"/dev/shm:/dev/shm/ngpt:/var/log/scrollkeeper.log:" |
| 189 |
"/usr/tmp/conftest:/usr/lib/conftest:" |
| 190 |
"/usr/lib32/conftest:/usr/lib64/conftest:" |
| 191 |
"/usr/tmp/cf:/usr/lib/cf:/usr/lib32/cf:/usr/lib64/cf", |
| 192 |
sandbox_info->home_dir, sandbox_info->home_dir, |
| 193 |
sandbox_info->work_dir[0] != '\0' ? sandbox_info->work_dir |
| 194 |
: "", |
| 195 |
sandbox_info->tmp_dir, sandbox_info->var_tmp_dir, |
| 196 |
"/tmp/:/var/tmp/"); |
| 197 |
if (SB_BUF_LEN <= retval) { |
| 198 |
errno = EMSGSIZE; |
| 199 |
perror("sandbox: Failed to generate SANDBOX_WRITE"); |
| 200 |
return -1; |
| 201 |
} |
| 202 |
|
| 203 |
return 0; |
| 204 |
} |
| 205 |
|
| 206 |
int get_sandbox_predict_envvar(char *buf, struct sandbox_info_t *sandbox_info) |
| 207 |
{ |
| 208 |
int retval = 0; |
| 209 |
/* bzero out entire buffer then append trailing 0 */ |
| 210 |
memset(buf, 0, SB_BUF_LEN); |
| 211 |
|
| 212 |
/* these should go into make.globals later on */ |
| 213 |
retval = snprintf(buf, SB_BUF_LEN, "%s/.:" |
| 214 |
"/usr/lib/python2.0/:" |
| 215 |
"/usr/lib/python2.1/:" |
| 216 |
"/usr/lib/python2.2/:" |
| 217 |
"/usr/lib/python2.3/:" |
| 218 |
"/usr/lib/python2.4/:" |
| 219 |
"/usr/lib/python2.5/:" |
| 220 |
"/usr/lib/python3.0/:" |
| 221 |
"/var/db/aliases.db:" |
| 222 |
"/var/db/netgroup.db:" |
| 223 |
"/var/db/netmasks.db:" |
| 224 |
"/var/db/ethers.db:" |
| 225 |
"/var/db/rpc.db:" |
| 226 |
"/var/db/protocols.db:" |
| 227 |
"/var/db/services.db:" |
| 228 |
"/var/db/networks.db:" |
| 229 |
"/var/db/hosts.db:" |
| 230 |
"/var/db/group.db:" |
| 231 |
"/var/db/passwd.db", |
| 232 |
sandbox_info->home_dir); |
| 233 |
if (SB_BUF_LEN <= retval) { |
| 234 |
errno = EMSGSIZE; |
| 235 |
perror("sandbox: Failed to generate SANDBOX_PREDICT"); |
| 236 |
return -1; |
| 237 |
} |
| 238 |
|
| 239 |
return 0; |
| 240 |
} |
| 241 |
|
| 242 |
int sandbox_setenv(char **env, const char *name, const char *val) { |
| 243 |
char **tmp_env = env; |
| 244 |
char *tmp_string = NULL; |
| 245 |
int retval = 0; |
| 246 |
|
| 247 |
/* XXX: We add the new variable to the end (no replacing). If this |
| 248 |
* is changed, we need to fix sandbox_setup_environ() below */ |
| 249 |
while (NULL != *tmp_env) |
| 250 |
tmp_env++; |
| 251 |
|
| 252 |
/* strlen(name) + strlen(val) + '=' + '\0' */ |
| 253 |
/* FIXME: Should probably free this at some stage - more neatness than |
| 254 |
* a real leak that will cause issues. */ |
| 255 |
tmp_string = calloc(strlen(name) + strlen(val) + 2, sizeof(char *)); |
| 256 |
if (NULL == tmp_string) { |
| 257 |
perror("sandbox: Out of memory (sandbox_setenv)"); |
| 258 |
exit(EXIT_FAILURE); |
| 259 |
} |
| 260 |
|
| 261 |
retval = snprintf(tmp_string, strlen(name) + strlen(val) + 2, "%s=%s", |
| 262 |
name, val); |
| 263 |
*tmp_env = tmp_string; |
| 264 |
|
| 265 |
return 0; |
| 266 |
} |
| 267 |
|
| 268 |
/* We setup the environment child side only to prevent issues with |
| 269 |
* setting LD_PRELOAD parent side */ |
| 270 |
char **sandbox_setup_environ(struct sandbox_info_t *sandbox_info) |
| 271 |
{ |
| 272 |
int env_size = 0; |
| 273 |
int have_ld_preload = 0; |
| 274 |
|
| 275 |
char **new_environ; |
| 276 |
char **env_ptr = environ; |
| 277 |
char sandbox_write_envvar[SB_BUF_LEN]; |
| 278 |
char sandbox_predict_envvar[SB_BUF_LEN]; |
| 279 |
char *ld_preload_envvar = NULL; |
| 280 |
char *orig_ld_preload_envvar = NULL; |
| 281 |
char sb_pid[64]; |
| 282 |
|
| 283 |
/* Unset these, as its easier than replacing when setting up our |
| 284 |
* new environment below */ |
| 285 |
unsetenv(ENV_SANDBOX_ON); |
| 286 |
unsetenv(ENV_SANDBOX_PID); |
| 287 |
unsetenv(ENV_SANDBOX_LIB); |
| 288 |
unsetenv(ENV_SANDBOX_BASHRC); |
| 289 |
unsetenv(ENV_SANDBOX_LOG); |
| 290 |
unsetenv(ENV_SANDBOX_DEBUG_LOG); |
| 291 |
unsetenv(ENV_SANDBOX_ACTIVE); |
| 292 |
|
| 293 |
if (NULL != getenv(ENV_LD_PRELOAD)) { |
| 294 |
have_ld_preload = 1; |
| 295 |
orig_ld_preload_envvar = getenv(ENV_LD_PRELOAD); |
| 296 |
|
| 297 |
/* FIXME: Should probably free this at some stage - more neatness |
| 298 |
* than a real leak that will cause issues. */ |
| 299 |
ld_preload_envvar = calloc(strlen(orig_ld_preload_envvar) + |
| 300 |
strlen(sandbox_info->sandbox_lib) + 2, |
| 301 |
sizeof(char *)); |
| 302 |
if (NULL == ld_preload_envvar) |
| 303 |
return NULL; |
| 304 |
snprintf(ld_preload_envvar, strlen(orig_ld_preload_envvar) + |
| 305 |
strlen(sandbox_info->sandbox_lib) + 2, "%s %s", |
| 306 |
sandbox_info->sandbox_lib, orig_ld_preload_envvar); |
| 307 |
} else { |
| 308 |
/* FIXME: Should probably free this at some stage - more neatness |
| 309 |
* than a real leak that will cause issues. */ |
| 310 |
ld_preload_envvar = gstrndup(sandbox_info->sandbox_lib, |
| 311 |
strlen(sandbox_info->sandbox_lib)); |
| 312 |
if (NULL == ld_preload_envvar) |
| 313 |
return NULL; |
| 314 |
} |
| 315 |
/* Do not unset this, as strange things might happen */ |
| 316 |
/* unsetenv(ENV_LD_PRELOAD); */ |
| 317 |
|
| 318 |
while (NULL != *env_ptr) { |
| 319 |
env_size++; |
| 320 |
env_ptr++; |
| 321 |
} |
| 322 |
|
| 323 |
/* FIXME: Should probably free this at some stage - more neatness than |
| 324 |
* a real leak that will cause issues. */ |
| 325 |
new_environ = calloc((env_size + 15 + 1) * sizeof(char *), sizeof(char *)); |
| 326 |
if (NULL == new_environ) |
| 327 |
return NULL; |
| 328 |
|
| 329 |
snprintf(sb_pid, sizeof(sb_pid), "%i", getpid()); |
| 330 |
|
| 331 |
/* First add our new variables to the beginning - this is due to some |
| 332 |
* weirdness that I cannot remember */ |
| 333 |
sandbox_setenv(new_environ, ENV_SANDBOX_ON, "1"); |
| 334 |
sandbox_setenv(new_environ, ENV_SANDBOX_PID, sb_pid); |
| 335 |
sandbox_setenv(new_environ, ENV_SANDBOX_LIB, sandbox_info->sandbox_lib); |
| 336 |
sandbox_setenv(new_environ, ENV_SANDBOX_BASHRC, sandbox_info->sandbox_rc); |
| 337 |
sandbox_setenv(new_environ, ENV_SANDBOX_LOG, sandbox_info->sandbox_log); |
| 338 |
sandbox_setenv(new_environ, ENV_SANDBOX_DEBUG_LOG, |
| 339 |
sandbox_info->sandbox_debug_log); |
| 340 |
/* Just set the these if not already set so that is_env_on() work */ |
| 341 |
if (!getenv(ENV_SANDBOX_VERBOSE)) |
| 342 |
sandbox_setenv(new_environ, ENV_SANDBOX_VERBOSE, "1"); |
| 343 |
if (!getenv(ENV_SANDBOX_DEBUG)) |
| 344 |
sandbox_setenv(new_environ, ENV_SANDBOX_DEBUG, "0"); |
| 345 |
if (!getenv(ENV_NOCOLOR)) |
| 346 |
sandbox_setenv(new_environ, ENV_NOCOLOR, "0"); |
| 347 |
/* If LD_PRELOAD was not set, set it here, else do it below */ |
| 348 |
if (1 != have_ld_preload) |
| 349 |
sandbox_setenv(new_environ, ENV_LD_PRELOAD, ld_preload_envvar); |
| 350 |
|
| 351 |
if (!getenv(ENV_SANDBOX_DENY)) |
| 352 |
sandbox_setenv(new_environ, ENV_SANDBOX_DENY, LD_PRELOAD_FILE); |
| 353 |
|
| 354 |
if (!getenv(ENV_SANDBOX_READ)) |
| 355 |
sandbox_setenv(new_environ, ENV_SANDBOX_READ, "/"); |
| 356 |
|
| 357 |
if (-1 == get_sandbox_write_envvar(sandbox_write_envvar, sandbox_info)) |
| 358 |
return NULL; |
| 359 |
if (!getenv(ENV_SANDBOX_WRITE)) |
| 360 |
sandbox_setenv(new_environ, ENV_SANDBOX_WRITE, sandbox_write_envvar); |
| 361 |
|
| 362 |
if (-1 == get_sandbox_predict_envvar(sandbox_predict_envvar, sandbox_info)) |
| 363 |
return NULL; |
| 364 |
if (!getenv(ENV_SANDBOX_PREDICT)) |
| 365 |
sandbox_setenv(new_environ, ENV_SANDBOX_PREDICT, sandbox_predict_envvar); |
| 366 |
|
| 367 |
/* Make sure our bashrc gets preference */ |
| 368 |
sandbox_setenv(new_environ, ENV_BASH_ENV, sandbox_info->sandbox_rc); |
| 369 |
|
| 370 |
/* This one should NEVER be set in ebuilds, as it is the one |
| 371 |
* private thing libsandbox.so use to test if the sandbox |
| 372 |
* should be active for this pid, or not. |
| 373 |
* |
| 374 |
* azarah (3 Aug 2002) |
| 375 |
*/ |
| 376 |
|
| 377 |
sandbox_setenv(new_environ, ENV_SANDBOX_ACTIVE, SANDBOX_ACTIVE); |
| 378 |
|
| 379 |
env_size = 0; |
| 380 |
while (NULL != new_environ[env_size]) |
| 381 |
env_size++; |
| 382 |
|
| 383 |
/* Now add the rest */ |
| 384 |
env_ptr = environ; |
| 385 |
while (NULL != *env_ptr) { |
| 386 |
if ((1 == have_ld_preload) && |
| 387 |
(strstr(*env_ptr, LD_PRELOAD_EQ) == *env_ptr)) |
| 388 |
/* If LD_PRELOAD was set, and this is it in the original |
| 389 |
* environment, replace it with our new copy */ |
| 390 |
/* XXX: The following works as it just add whatever as |
| 391 |
* the last variable to nev_environ */ |
| 392 |
sandbox_setenv(new_environ, ENV_LD_PRELOAD, |
| 393 |
ld_preload_envvar); |
| 394 |
else |
| 395 |
new_environ[env_size + (env_ptr - environ)] = *env_ptr; |
| 396 |
env_ptr++; |
| 397 |
} |
| 398 |
|
| 399 |
return new_environ; |
| 400 |
} |
| 401 |
|
| 402 |
int spawn_shell(char *argv_bash[], char *env[], int debug) |
| 403 |
{ |
| 404 |
int status = 0; |
| 405 |
int ret = 0; |
| 406 |
|
| 407 |
child_pid = fork(); |
| 408 |
|
| 409 |
/* Child's process */ |
| 410 |
if (0 == child_pid) { |
| 411 |
execve(argv_bash[0], argv_bash, env); |
| 412 |
return 0; |
| 413 |
} else if (child_pid < 0) { |
| 414 |
if (debug) |
| 415 |
fprintf(stderr, "Process failed to spawn!\n"); |
| 416 |
return 0; |
| 417 |
} |
| 418 |
ret = waitpid(child_pid, &status, 0); |
| 419 |
if ((-1 == ret) || (status > 0)) { |
| 420 |
if (debug) |
| 421 |
fprintf(stderr, "Process returned with failed exit status!\n"); |
| 422 |
return 0; |
| 423 |
} |
| 424 |
|
| 425 |
return 1; |
| 426 |
} |
| 427 |
|
| 428 |
int main(int argc, char **argv) |
| 429 |
{ |
| 430 |
int i = 0, success = 1; |
| 431 |
int sandbox_log_presence = 0; |
| 432 |
long len; |
| 433 |
|
| 434 |
struct sandbox_info_t sandbox_info; |
| 435 |
|
| 436 |
char **sandbox_environ; |
| 437 |
char **argv_bash = NULL; |
| 438 |
|
| 439 |
char *run_str = "-c"; |
| 440 |
|
| 441 |
/* Only print info if called with no arguments .... */ |
| 442 |
if (argc < 2) |
| 443 |
print_debug = 1; |
| 444 |
|
| 445 |
if (print_debug) |
| 446 |
printf("========================== Gentoo linux path sandbox ===========================\n"); |
| 447 |
|
| 448 |
/* check if a sandbox is already running */ |
| 449 |
if (NULL != getenv(ENV_SANDBOX_ACTIVE)) { |
| 450 |
fprintf(stderr, "Not launching a new sandbox instance\n"); |
| 451 |
fprintf(stderr, "Another one is already running in this process hierarchy.\n"); |
| 452 |
exit(EXIT_FAILURE); |
| 453 |
} |
| 454 |
|
| 455 |
/* determine the location of all the sandbox support files */ |
| 456 |
if (print_debug) |
| 457 |
printf("Detection of the support files.\n"); |
| 458 |
|
| 459 |
if (-1 == sandbox_setup(&sandbox_info)) { |
| 460 |
fprintf(stderr, "sandbox: Failed to setup sandbox."); |
| 461 |
exit(EXIT_FAILURE); |
| 462 |
} |
| 463 |
|
| 464 |
/* verify the existance of required files */ |
| 465 |
if (print_debug) |
| 466 |
printf("Verification of the required files.\n"); |
| 467 |
|
| 468 |
#ifndef SB_HAVE_MULTILIB |
| 469 |
if (0 >= exists(sandbox_info.sandbox_lib)) { |
| 470 |
perror("sandbox: Could not open the sandbox library"); |
| 471 |
exit(EXIT_FAILURE); |
| 472 |
} |
| 473 |
#endif |
| 474 |
if (0 >= exists(sandbox_info.sandbox_rc)) { |
| 475 |
perror("sandbox: Could not open the sandbox rc file"); |
| 476 |
exit(EXIT_FAILURE); |
| 477 |
} |
| 478 |
|
| 479 |
/* set up the required environment variables */ |
| 480 |
if (print_debug) |
| 481 |
printf("Setting up the required environment variables.\n"); |
| 482 |
|
| 483 |
/* Setup the child environment stuff */ |
| 484 |
sandbox_environ = sandbox_setup_environ(&sandbox_info); |
| 485 |
if (NULL == sandbox_environ) { |
| 486 |
perror("sandbox: Out of memory (environ)"); |
| 487 |
exit(EXIT_FAILURE); |
| 488 |
} |
| 489 |
|
| 490 |
/* If not in portage, cd into it work directory */ |
| 491 |
if ('\0' != sandbox_info.work_dir[0]) |
| 492 |
chdir(sandbox_info.work_dir); |
| 493 |
|
| 494 |
argv_bash = (char **)malloc(6 * sizeof(char *)); |
| 495 |
argv_bash[0] = strdup("/bin/bash"); |
| 496 |
argv_bash[1] = strdup("-rcfile"); |
| 497 |
argv_bash[2] = strdup(sandbox_info.sandbox_rc); |
| 498 |
|
| 499 |
if (argc < 2) |
| 500 |
argv_bash[3] = NULL; |
| 501 |
else |
| 502 |
argv_bash[3] = strdup(run_str); /* "-c" */ |
| 503 |
|
| 504 |
argv_bash[4] = NULL; /* strdup(run_arg); */ |
| 505 |
argv_bash[5] = NULL; |
| 506 |
|
| 507 |
if (argc >= 2) { |
| 508 |
for (i = 1; i < argc; i++) { |
| 509 |
if (NULL == argv_bash[4]) |
| 510 |
len = 0; |
| 511 |
else |
| 512 |
len = strlen(argv_bash[4]); |
| 513 |
|
| 514 |
argv_bash[4] = (char *)realloc(argv_bash[4], |
| 515 |
(len + strlen(argv[i]) + 2) * sizeof(char)); |
| 516 |
|
| 517 |
if (0 == len) |
| 518 |
argv_bash[4][0] = 0; |
| 519 |
if (1 != i) |
| 520 |
strcat(argv_bash[4], " "); |
| 521 |
|
| 522 |
strcat(argv_bash[4], argv[i]); |
| 523 |
} |
| 524 |
} |
| 525 |
|
| 526 |
/* set up the required signal handlers */ |
| 527 |
signal(SIGHUP, &stop); |
| 528 |
signal(SIGINT, &stop); |
| 529 |
signal(SIGQUIT, &stop); |
| 530 |
signal(SIGTERM, &stop); |
| 531 |
signal(SIGUSR1, &stop); |
| 532 |
|
| 533 |
/* STARTING PROTECTED ENVIRONMENT */ |
| 534 |
if (print_debug) { |
| 535 |
printf("The protected environment has been started.\n"); |
| 536 |
printf("--------------------------------------------------------------------------------\n"); |
| 537 |
} |
| 538 |
|
| 539 |
if (print_debug) |
| 540 |
printf("Process being started in forked instance.\n"); |
| 541 |
|
| 542 |
/* Start Bash */ |
| 543 |
if (!spawn_shell(argv_bash, sandbox_environ, print_debug)) |
| 544 |
success = 0; |
| 545 |
|
| 546 |
/* Free bash stuff */ |
| 547 |
for (i = 0; i < 6; i++) { |
| 548 |
if (argv_bash[i]) |
| 549 |
free(argv_bash[i]); |
| 550 |
argv_bash[i] = NULL; |
| 551 |
} |
| 552 |
if (argv_bash) |
| 553 |
free(argv_bash); |
| 554 |
argv_bash = NULL; |
| 555 |
|
| 556 |
if (print_debug) |
| 557 |
printf("Cleaning up sandbox process\n"); |
| 558 |
|
| 559 |
if (print_debug) { |
| 560 |
printf("========================== Gentoo linux path sandbox ===========================\n"); |
| 561 |
printf("The protected environment has been shut down.\n"); |
| 562 |
} |
| 563 |
|
| 564 |
if (1 == exists(sandbox_info.sandbox_log)) { |
| 565 |
sandbox_log_presence = 1; |
| 566 |
print_sandbox_log(sandbox_info.sandbox_log); |
| 567 |
} else if (print_debug) { |
| 568 |
printf("--------------------------------------------------------------------------------\n"); |
| 569 |
} |
| 570 |
|
| 571 |
if ((sandbox_log_presence) || (!success)) |
| 572 |
return 1; |
| 573 |
else |
| 574 |
return 0; |
| 575 |
} |
| 576 |
|
| 577 |
// vim:noexpandtab noai:cindent ai |
Parent Directory
| 
Revision Log