Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
path: root/libsbutil
Commit message (Collapse)AuthorAgeFilesLines
* libsbutil: fix -Wold-style-declarationSam James2023-08-081-1/+1
| | | | | Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsbutil: add sbio_faccessat and use it in sb_existsMike Gilbert2023-08-032-0/+11
| | | | | | | | | | | | | sbio_faccessat allows libsbutil to access the unwrapped version of faccessat when called from libsandbox. Using faccessat in place of fstatat seems to give a small boost in performance. Pass AT_EACCESS faccessat to enable a faster path if uid != euid. Bug: https://bugs.gentoo.org/910273 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* sb_exists: drop use of faccessatMike Gilbert2023-07-171-10/+0
| | | | | | | | faccessat appears to perform quite poorly under certain conditions. Go back to using fstatat until this can be debugged. Bug: https://bugs.gentoo.org/910273 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsbutil: add sb_exists functionMike Gilbert2023-06-214-1/+27
| | | | | | | | | This provides a central place to work around a bug on musl where faccessat sets errno to EINVAL when the kernel does not support faccessat2. Bug: https://bugs.gentoo.org/908765 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* change FS calls to use 64-bit interfaces explicitlyMike Frysinger2021-11-053-15/+15
| | | | | | | | | Make sure we use 64-bit FS interfaces when accessing the FS. This is needed not only to stat or open large files, but even files with 64-bit inodes. Bug: https://bugs.gentoo.org/583282 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: move xasprintf helper hereMike Frysinger2021-11-051-9/+8
| | | | | | | | Since this is only used by sandbox, and is not usable by libsandbox, move it out of libsbutil. Leave a note behind for possible future macros too. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox/libsbutil: use faccessat for file-existence testsMike Frysinger2021-11-051-13/+1
| | | | | | | | This is faster than using stat since it doesn't have to gather all the metadata, and should avoid LFS issues as a result. Bug: https://bugs.gentoo.org/583282 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Revert "Force sandbox-internal functions to use 64bit file interface"Mike Frysinger2021-11-051-1/+0
| | | | | | | | | | | | | | This reverts commit 19c215f245faf9a453e7171bddccc690c03f7b72. We do not want different LFS interfaces being used in different modules as it makes debugging a nightmare when different functions think basic structures have different layouts & sizes. This also doesn't address the LFS issues sandbox has when code still crashes in libsandbox itself when checking accesses. Bug: https://bugs.gentoo.org/681892 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: restore SANDBOX_INTRACTV variableMike Frysinger2021-11-051-0/+2
| | | | | | | | I incorrectly dropped this as unused a while back, but the bashrc hook definitely still relies on it for checking portage settings. I think I got confused by the interaction with SANDBOX_TESTING. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Force sandbox-internal functions to use 64bit file interfaceAndreas K. Hüttel2021-11-031-0/+1
| | | | | | | | | This works around problems when a 64bit qemu is emulating a 32bit architecture. LFS has been present since glibc-2.2 and kernel 2.4. Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
* libsbutil: drop fsync when loggingMike Frysinger2021-11-031-1/+0
| | | | | | | | | | | | | This was added as part of running multiple tracers in parallel in the hopes (hack) it would make logs less intermingled. Unfortunately, it didn't really accomplish that, and it upsets `file` when verbose output is enabled due to file's own seccomp filter (which doesn't have fsync). We could add this to file's seccomp filter (since it's a pretty benign syscall), but easier to just drop it at this point since it's not all that useful. Bug: https://bugs.gentoo.org/821403 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: fix ptracing childrenMike Frysinger2021-11-022-0/+10
| | | | | | | | | | | | | | | | The ptrace logic was largely built around the assumption of execing a single static binary and that's it. But there's nothing stopping it from also forking & creating children. Today, that means children do not get tracked for problems. One major known issue is that the sandbox env is frozen upon launch. So once we switch to ptrace mode, it's not possible for traced code to disable sandboxing or otherwise reconfigure it. Currently that shouldn't be a big deal as we assume the main execution environment (i.e. bash) is dynamic, and that's where the env will be tweaked, but we'll have to address this before we can deploy ptrace more. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: add a --run-configure optionMike Frysinger2021-10-231-0/+8
| | | | | | | | | When setting up sandbox on a new system for development, it helps to be able to build the new sandbox checkout in the same way as it is currently installed in the system. Add a command line option for this explicitly to speed up development. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* build: hoist -Itop_srcdir to common AM_CPPFLAGSMike Frysinger2021-10-231-1/+0
| | | | | | | Every subdir sets this var this way, so might as well unify it. We keep very few files in here, so shouldn't be a future problem. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Revert "Remove leftover generated Makefiles from the repo (sic!)"Mike Frysinger2021-10-221-0/+4
| | | | | | | This reverts commit 53ffbaeb24f6ee22a2dcd70fad29c86a4dd863c2. These files are supposed to be in here. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Remove leftover generated Makefiles from the repo (sic!)Michał Górny2021-10-221-4/+0
| | | | Signed-off-by: Michał Górny <mgorny@gentoo.org>
* delete redundant headers.h stubMike Frysinger2021-10-212-2/+0
| | | | | | | These dirs have -I paths to the top-level, so these redirects aren't that useful anymore. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* tests: add a convenience build targetMike Frysinger2021-10-211-1/+1
| | | | | | | This makes it easy to quickly compile all the tools without actually running the testsuite. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* build: flatten build a bit to avoid (most) recursive makeMike Frysinger2021-10-213-71/+69
| | | | | | Provides a bit of a speed up. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: add SANDBOX_METHOD settingMike Frysinger2021-10-183-0/+46
| | | | | | | | | | This allows people to disable use of ptrace if their configuration does not support it. This forces older sandbox behavior where we cannot protect against static or set*id programs. Bug: https://bugs.gentoo.org/648516 Bug: https://bugs.gentoo.org/771360 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: add assert to testing code pathMike Frysinger2021-10-181-0/+1
| | | | | | This makes it more obvious when the env is (incorrectly) partially setup. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: elide sb_maybe_gdb when -DNDEBUG is usedGuenther Brunthaler2016-11-271-0/+2
| | | | | | | | Since sb_maybe_gdb is set up as a stub macro, make sure we don't define the function either to cut down on size and build failures (when the macro tries to expand the function prototype). URL: https://bugs.gentoo.org/600550
* libsbutil: clean up same.h distdir usageMike Frysinger2016-01-181-1/+0
| | | | | | | In commit 7a923f646ce10b7dec3c7ae5fe2079c10aa21752, we dropped the same.h header, but the build still listed it. Drop it from the distdir list. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: gnulib: hand disable same_name usageMike Frysinger2015-12-202-34/+0
| | | | | | | | We don't provide same_name because the one caller we don't use, but it relies on gc-sections to avoid link errors. That flag doesn't work on ia64 though, so we need to hand delete the one caller. Ugh. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: avoid mixing stderr & output pipesMike Frysinger2015-12-202-1/+14
| | | | | | | | | | | | The various debug helpers were changed to write out to a dedicated message path, but some of the trace code still uses stderr directly. When mixing these methods, the direct prints would sometimes be lost. Convert the few users to a new raw print function so they all route through the same file. We might want to extract this a bit more out in the future so it's easier to write to them, but this should be fine for now. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sb_efuncs: avoid pointless stdio indirectionMike Frysinger2015-12-191-8/+8
| | | | | | | | We were setting up a FILE* from a file descriptor to pass to sb_fprintf which is a simple macro that calls fileno(fp) to pass the fd down. We can call the fd funcs directly and avoid the whole stdio business. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: add helpers for reading config options (w/out env export)Mike Frysinger2015-09-262-13/+32
| | | | | | | | | All sandbox settings thus far have been for libsandbox.so to process. With newer features though, we have settings that might only apply to the main sandbox program. Add some helper functions for parsing out those settings (which a later commit will utilize). Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: gnulib: mark xgetcwd static inlineMike Frysinger2015-09-261-5/+1
| | | | | | | | | | Rather than use gnu inline where gcc can create external references (which we don't provide), just always inline the xgetcwd func. This fixes building at -O0 optimization levels. URL: https://bugs.gentoo.org/561342 Reported-by: Pryka <pryka.iluvatar@gmail.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: gnulib: import modules for canonicalize_filename_modeMike Frysinger2015-09-2026-0/+2709
| | | | | | | | | | | | | | | | | | | | | | This lays the groundwork for fixing handling of broken symlinks. The gnulib code is hand imported because using the gnulib tool imports a ton of code we do not want. Only the bare minimum is imported so we can use the canonicalize_filename_mode function. This function is needed to canonicalize symlinks that are ultimately broken. The current sandbox/C library code only supports two modes: (1) dereference a single symlink (2) dereference *all* symlinks, but only if all links are valid For sandbox, we need to know the final path a symlink points to even if that path doesn't (yet) exist. Note: This commit doesn't actually fix the bug, just brings in the functions we need to do so. URL: https://bugs.gentoo.org/540828 Reported-by: Rick Farina <zerochaos@gentoo.org> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: undef memory redirect callsMike Frysinger2015-09-201-0/+6
| | | | | | | | | Sometimes the C library will redirect a call to strdup to __strdup which breaks when we're using the libsandbox memory allocator. This was fixed in libsandbox in commit d7801453aced46a6f31d8455877edeb31a5211cc, but we didn't notice in libsbutil as no calls to strdup happened to come up. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: use a non-shell var for the message pathMike Frysinger2013-03-031-1/+1
| | | | | | | | | | | | | | | | | By allowing the SANDBOX_MESSAGE_PATH var to be stored in the shell environment and then modified on the fly, we run into a fun edge case with the PM. When a phase has finished running, it saves the current environment. When the next phase runs, it loads the env from the previous run. Since the message path var can contain a pid, the previous run will no longer be valid. Since we want this to simply be a way for the active sandbox to pass information to the active libsandbox.so's, there's no need to use an env var that the shell can save/reload. As such, use a variable name that the shell will skip. Non-shell programs have no problem with this. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: accept SANDBOX_LOG vars whatever their valuesMike Frysinger2013-03-031-9/+5
| | | | | | | | | | | | | | | Commit 40abb498ca4a24495fe34e133379382ce8c3eaca subtly broke the sandbox with portage. It changed how the sandbox log env var was accessed by moving from getenv() to get_sandbox_log(). The latter has path checking and will kick out values that contain a slash. That means every time a new process starts, a new sandbox log path will be generated, and when a program triggers a violation, it'll write to the new file. Meanwhile, portage itself watches the original one which never gets updated. This code has been around forever w/out documentation, and I can't think of a reason we need it. So punt it. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sb_efuncs: fix thinko in message patchMike Frysinger2013-03-031-1/+1
| | | | | | Forgot to assign the fallback open to the fd. Whee. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: clean up open file handles in parent tracing processMike Frysinger2012-06-232-1/+26
| | | | | | | | | | | | | | Currently, if a non-static app sets up a pipe (with cloexec enabled) and executes a static app, the handle to that pipe is left open in the parent process. This causes trouble when the parent is waiting for that to be closed immediately. Since none of the fds in the forked parent process matter to us, we can just go ahead and clean up all fds before we start tracing the child. URL: http://bugs.gentoo.org/364877 Reported-by: Victor Stinner <victor.stinner@haypocalc.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* environ: add set variants to env_is_{on,off}Mike Frysinger2013-02-222-7/+21
| | | | | | | | In some situations, we want to know the tristate of "is on", "is off", and "is set" instead of just lumping the "is not set" case in with "is off". Add some helpers for that. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* add a new message env varMike Frysinger2013-02-243-49/+25
| | | | | | | | | | | | | | | | | | | | | | | | This is used whenever sandbox wants to display an informational message. For example, early notification of a path violation, or debugging output. We can't just pop open an fd and pass that around as apps consider that leakage and will often break assumptions in terms of free fds. Or apps that start up and cleanse all of their open fds. So instead, we just pass around an env var that holds the full path to the file we want will write to. Since these messages are infrequent (compared to overall runtime), opening/writing/closing the path every time is fine. This also avoids all the problems associated with using external portage helpers for writing messages. A follow up commit will take care of the situation where apps (such as scons) attempt to also cleanse the env before forking. URL: http://bugs.gentoo.org/278761 URL: http://bugs.gentoo.org/431638 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* delete unused sandbox env varsMike Frysinger2013-02-241-7/+0
| | | | | | Nothing uses or cares about these vars, so punt them. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* environ: add a new is_env_var helper for checking var namesMike Frysinger2013-02-241-3/+6
| | | | | | | This is laying the ground work for processing more vars in the future than just LD_PRELOAD. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* environ: merge is_env_{on,off} into a single fileMike Frysinger2013-02-244-46/+46
| | | | | | Start a centralized place for environment related helper funcs. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sb_gdb: improve gdb integrationMike Frysinger2012-12-244-20/+78
| | | | | | | | | | | | | | | | Add a dedicated entry point for connecting gdb to make it easy to connect gdb at arbitrary points (ala printf style debugging). This also smooths a lot of the common steps when automatically launching gdb such as making sure the process is closer to the crash point when the user takes over control of gdb. Finally, switch to using clone rather than fork since the latter relies on the C lib's fork which implicitly can grab locks. If we're crashing in the middle of a func that already holds those locks, the fork call will hang indefinitely on us. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sb_efuncs: fix usage of portage handlersMike Frysinger2012-12-241-7/+17
| | | | | | | | | | | | | | | | | | | | The previous change forgot to actually enable the portage helpers. This meant violation output would always get sent to /dev/tty rather than to portage's logging facilities. Enable the helper logic while also fixing a logic error with va_args (you can't re-use the same va_args). Also, in order to use these with code that watches over SIGCHLD via sigaction, we need to use sigaction ourselves to ignore that signal. This might be racy with threaded apps that fork & watch SIGCHLD. Testing in the larger world will show whether we need to revisit how we communicate with the PM. URL: http://bugs.gentoo.org/431638 Reported-by: Michael Weiser <michael@weiser.dinsnail.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: allow log files to fallback to tmpdirMike Frysinger2012-12-242-8/+15
| | | | | | | | Since non-root users typically do not have write access to /var/log, allow it to fallback to standard tmpdirs. This makes testing locally a lot easier. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sb_efunc: deleteMike Frysinger2012-12-241-25/+0
| | | | | | Completely unused. GOOD BYE. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sb_efuncs: fix NOCOLOR handlingMike Frysinger2012-11-231-2/+5
| | | | | | | Need to set the colors to "" rather than NULL so we don't print out "(null)" where the colors normally would be. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* precompile headers.h to speed up build slightlyMike Frysinger2012-07-032-0/+2
| | | | | | | Since all system headers are included by way of headers.h, we can pre-compile this to speed up the build up a bit. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sb_printf: expand feature set slightly and fix testingMike Frysinger2012-07-021-12/+36
| | | | | | | | | | This adds support for signed ll, unsigned z, l, and ll, hex l, and ll, ignores the # for hex output since this is what we do implicitly already. As for testing, looks like during the autogeneration of testsuite.list.at, the sb_printf test was lost. Restore it so it gets run again. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* significantly overhaul output helpersMike Frysinger2012-06-238-62/+321
| | | | | | | | | | | | | | | | | | | | There are a few major points we want to hit here: - have all output from libsandbox go through portage helpers when we are in the portage environment so that output is properly logged - convert SB_E{info,warn,error} to sb_e{info,warn,error} to match style of other functions and cut down on confusion - move all abort/output helpers to libsbutil so it can be used in all source trees and not just by libsandbox - migrate all abort points to the centralized sb_ebort helper Unfortunately, it's not terribly easy to untangle these into separate patches, but hopefully this shouldn't be too messy as much of it is mechanical: move funcs between files, and change the name of funcs that get called. URL: http://bugs.gentoo.org/278761 Reported-by: Mounir Lamouri <volkmar@gentoo.org> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: create more defines for gcc attributesMike Frysinger2012-06-231-4/+4
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: drop beep supportMike Frysinger2012-06-231-3/+0
| | | | | | | | Almost no one has beep support turned on anymore, and ebeep in the main tree has been deprecated (meaning it wasn't found useful while building packages). So punt support for it from sandbox too. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: push down constructor initMike Frysinger2012-03-052-12/+1
| | | | | | | | | | | | | | Since every consumer of sb_open gets a copy of the sbio_open data, push the init of this into the .data section of the respective consumers to avoid the runtime overhead. This just leaves sandbox_lib setup in the constructor function, but that is only needed by the execve wrapper, so push down init of that to the existing sb_init logic which happens before our execve wrapper gets used. URL: http://bugs.gentoo.org/404013 Reported-by: Mike Gilbert <floppym@gentoo.org> Signed-off-by: Mike Frysinger <vapier@gentoo.org>