From owner-svn-soc-all@FreeBSD.ORG Wed Sep 4 18:59:40 2013 Return-Path: Delivered-To: svn-soc-all@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 29CBF992 for ; Wed, 4 Sep 2013 18:59:40 +0000 (UTC) (envelope-from dpl@FreeBSD.org) Received: from socsvn.freebsd.org (socsvn.freebsd.org [IPv6:2001:1900:2254:206a::50:2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 15C7C2C54 for ; Wed, 4 Sep 2013 18:59:40 +0000 (UTC) Received: from socsvn.freebsd.org ([127.0.1.124]) by socsvn.freebsd.org (8.14.7/8.14.7) with ESMTP id r84IxdSO095338 for ; Wed, 4 Sep 2013 18:59:39 GMT (envelope-from dpl@FreeBSD.org) Received: (from www@localhost) by socsvn.freebsd.org (8.14.7/8.14.6/Submit) id r84Ixdxp095335 for svn-soc-all@FreeBSD.org; Wed, 4 Sep 2013 18:59:39 GMT (envelope-from dpl@FreeBSD.org) Date: Wed, 4 Sep 2013 18:59:39 GMT Message-Id: <201309041859.r84Ixdxp095335@socsvn.freebsd.org> X-Authentication-Warning: socsvn.freebsd.org: www set sender to dpl@FreeBSD.org using -f From: dpl@FreeBSD.org To: svn-soc-all@FreeBSD.org Subject: socsvn commit: r256906 - soc2013/dpl/head/lib/libzcap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-soc-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the entire Summer of Code repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Sep 2013 18:59:40 -0000 Author: dpl Date: Wed Sep 4 18:59:39 2013 New Revision: 256906 URL: http://svnweb.FreeBSD.org/socsvn/?view=rev&rev=256906 Log: mini-update. Modified: soc2013/dpl/head/lib/libzcap/capsicum.c soc2013/dpl/head/lib/libzcap/capsicum.h Modified: soc2013/dpl/head/lib/libzcap/capsicum.c ============================================================================== --- soc2013/dpl/head/lib/libzcap/capsicum.c Wed Sep 4 18:28:03 2013 (r256905) +++ soc2013/dpl/head/lib/libzcap/capsicum.c Wed Sep 4 18:59:39 2013 (r256906) @@ -13,76 +13,20 @@ #include #include -external struct sandbox; -external struct slisthead sandboxes; +extern struct sandbox; +extern struct slisthead sandboxes; -int startChild(void); +struct sandbox * startSandbox(void *data); +int stopSandbox(struct sandbox *sandbox); +void startNullSandbox(void); +struct sandbox * findSandbox(void *ptr); +struct sandbox *startChild(void *data); void killChild(void); void suicide(int signal); -nvlist_t * sendCommand(nvlist_t *nvl); +nvlist_t * sendCommand(nvlist_t *nvl, int socket); bool slist_initiated = 0; -nvlist_t * -sendCommand(nvlist_t *nvl, int socket) -{ - nvlist_t *new; - if( nvlist_send(socket, nvl) != 0 ) - err(1, "zcaplib: nvlist_send() Went wrong"); - if ((new = nvlist_recv(socket)) == NULL) - err(1, "nvlist_recv(): nvlist_t is NULL"); - return (new); -} - -void killChild(void) { - kill(pid, SIGKILL); -} -void suicide(int signal) { - kill(getpid(), SIGKILL); -} - -void -startChild(void *data) -{ - int procd, sv[2]; - struct sandbox *newsandbox; - - if ((newsandbox = malloc(sizeof (struct sandbox)) == NULL) - err(1, "Couldn't allocate memory for sandboxes"); - - sv[0] = sv[1] = 0; - if (socketpair(PF_LOCAL, SOCK_STREAM, 0, sv) < 0 ) - perror("zcaplib: socketpair()"); - - procd = pdfork(); - if (pid == 0 ){ - if (cap_rights_limit(STDIN_FILENO, CAP_READ) < 0) - err(1, "Couldn't limit rights"); - if (cap_rights_limit(STDOUT_FILENO, CAP_WRITE|CAP_FSTAT) < 0) - err(1, "Couldn't limit rights"); - if (cap_rights_limit(STDERR_FILENO, CAP_WRITE) < 0) - err(1, "Couldn't limit rights"); - dup2(sv[0], 3); - if (cap_rights_limit(3, CAP_WRITE|CAP_READ|CAP_POLL_EVENT) < 0) - err(1, "Couldn't limit rights"); - closefrom(4); - - /* execl() zlibworker */ - if ( execl("/usr/libexec/zlibworker", "zlibworker", NULL) < 0) { - err(1, "Couldn't find zlibworker."); - } - exit(0); - } else if (pid == -1) { - err(1, "Couldn't fork"); - } else { - close(sv[1]); - signal(SIGCHLD, suicide); - atexit(killChild); - sandbox->dataptr = data; - sandbox->pd = procd; - sandbox->socket = sv[0]; - } -} /* * This function should be called only by: @@ -104,22 +48,6 @@ return (newsandbox); } -void -startNullSandbox(void) -{ - if (!slist_initiated) { - SLIST_INIT(&sandboxes); - - /* Here we add a sandbox used for non-structure related stuff */ - /* This will be the first sandbox always */ - if (SLIST_EMPTY(&sandboxes)) { - newsandbox = startChild(newsandbox, NULL); - SLIST_INSERT_HEAD(&sandboxes, newsandbox, entries); - } - } - slist_initiated = 1; -} - /* * Kills the sandbox, and deletes the associated * struct sandbox. Should be called by: gzclose, @@ -140,19 +68,33 @@ free(sandbox); } +/* Starts the default sandbox. */ +void +startNullSandbox(void) +{ + if (!slist_initiated) { + sandboxes = SLIST_HEAD_INITIALIZER(head); + SLIST_INIT(&sandboxes); + /* Here we add a sandbox used for non-structure related stuff */ + /* This will be the first sandbox always */ + if (SLIST_EMPTY(&sandboxes)) { + newsandbox = startChild(newsandbox, NULL); + SLIST_INSERT_HEAD(&sandboxes, newsandbox, entries); + } + } + slist_initiated = 1; +} + /* * Finds the struct sandbox for * a pointer to the data structure * the sandbox is related to. - * Returns NULL if not found. */ struct sandbox * -findsandbox(void *ptr) +findSandbox(void *ptr) { struct sandbox *sandbox; - sandbox = NULL; - if (ptr == NULL) return (SLIST_FIRST(&sandboxes)); @@ -162,4 +104,65 @@ /* Not found */ return (NULL); -} \ No newline at end of file +} + +struct sandbox * +startChild(void *data) +{ + int procd, sv[2]; + struct sandbox *newsandbox; + + if ((newsandbox = malloc(sizeof (struct sandbox)) == NULL) + err(1, "Couldn't allocate memory for sandboxes"); + + sv[0] = sv[1] = 0; + if (socketpair(PF_LOCAL, SOCK_STREAM, 0, sv) < 0 ) + perror("zcaplib: socketpair()"); + + procd = pdfork(); + if (pid == 0 ){ + if (cap_rights_limit(STDIN_FILENO, CAP_READ) < 0) + err(1, "Couldn't limit rights"); + if (cap_rights_limit(STDOUT_FILENO, CAP_WRITE|CAP_FSTAT) < 0) + err(1, "Couldn't limit rights"); + if (cap_rights_limit(STDERR_FILENO, CAP_WRITE) < 0) + err(1, "Couldn't limit rights"); + dup2(sv[0], 3); + if (cap_rights_limit(3, CAP_WRITE|CAP_READ|CAP_POLL_EVENT) < 0) + err(1, "Couldn't limit rights"); + closefrom(4); + + /* execl() zlibworker */ + if ( execl("/usr/libexec/zlibworker", "zlibworker", NULL) < 0) { + err(1, "Couldn't find zlibworker."); + } + exit(0); + } else if (pid == -1) { + err(1, "Couldn't fork"); + } else { + close(sv[1]); + signal(SIGCHLD, suicide); + atexit(killChild); + sandbox->dataptr = data; + sandbox->pd = procd; + sandbox->socket = sv[0]; + } +} + +void killChild(void) { + kill(pid, SIGKILL); +} +void suicide(int signal) { + kill(getpid(), SIGKILL); +} + +nvlist_t * +sendCommand(nvlist_t *nvl, int socket) +{ + nvlist_t *new; + if( nvlist_send(socket, nvl) != 0 ) + err(1, "zcaplib: nvlist_send() Went wrong"); + if ((new = nvlist_recv(socket)) == NULL) + err(1, "nvlist_recv(): nvlist_t is NULL"); + return (new); +} Modified: soc2013/dpl/head/lib/libzcap/capsicum.h ============================================================================== --- soc2013/dpl/head/lib/libzcap/capsicum.h Wed Sep 4 18:28:03 2013 (r256905) +++ soc2013/dpl/head/lib/libzcap/capsicum.h Wed Sep 4 18:59:39 2013 (r256906) @@ -18,16 +18,18 @@ #define MAXLEN (5*1024) -extern int pid; -extern int sv[2]; -extern struct sandbox * sandboxes; - -extern int startChild(void); -extern void killChild(void); -extern nvlist_t * sendCommand(nvlist_t *nvl); +struct sandbox * startSandbox(void *data); +int stopSandbox(struct sandbox *sandbox); +void startNullSandbox(void); +struct sandbox * findSandbox(void *ptr); +struct sandbox *startChild(void *data); +void killChild(void); +void suicide(int signal); +nvlist_t * sendCommand(nvlist_t *nvl, int socket); /* head of singly-linked list. */ -SLIST_HEAD(slisthead, sandbox) sandboxes = SLIST_HEAD_INITIALIZER(head); +struct slisthead sandboxes; +SLIST_HEAD(slisthead, sandbox) sandboxes; /* * This structure holds a relation of structs of data structs, @@ -38,4 +40,4 @@ int pd; /* Process descriptor */ int socket; /* Socket we have to pass the data through */ SLIST_ENTRY(entry) entries; /* Singly-linked list. */ -} +};