Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* src: fix -Wold-style-declarationSam James2023-08-081-2/+2
| | | | | | Signed-off-by: Sam James <sam@gentoo.org> Closes: https://github.com/gentoo/sandbox/pull/23 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* sandbox: do not compare array to NULLgto20232023-08-051-1/+1
| | | | | | | | | | | Fixes a compiler warning: ``` src/environ.c:211:19: warning: the comparison will always evaluate as ‘true’ for the address of ‘work_dir’ will never be NULL [-Waddress] ``` Bug: https://bugs.gentoo.org/906234 Signed-off-by: gto2023 <gto7052@mailbox.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* sandbox: prevent possible use of uninitialized members of sandbox_info structgto20232023-08-051-1/+1
| | | | | Signed-off-by: gto2023 <gto7052@mailbox.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* Rename multiple personalities featureSam James2023-08-051-3/+3
| | | | | | | | "schizo" isn't a particularly sensitive term, and it's not very clear what it means to non-native English speakers anyway. Name it after what the feature really does: multiple (Linux) personality support using ptrace. Signed-off-by: Sam James <sam@gentoo.org>
* libsbutil: add sbio_faccessat and use it in sb_existsMike Gilbert2023-08-031-0/+1
| | | | | | | | | | | | | sbio_faccessat allows libsbutil to access the unwrapped version of faccessat when called from libsandbox. Using faccessat in place of fstatat seems to give a small boost in performance. Pass AT_EACCESS faccessat to enable a faster path if uid != euid. Bug: https://bugs.gentoo.org/910273 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* change FS calls to use 64-bit interfaces explicitlyMike Frysinger2021-11-051-2/+2
| | | | | | | | | Make sure we use 64-bit FS interfaces when accessing the FS. This is needed not only to stat or open large files, but even files with 64-bit inodes. Bug: https://bugs.gentoo.org/583282 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: move xasprintf helper hereMike Frysinger2021-11-051-0/+8
| | | | | | | | Since this is only used by sandbox, and is not usable by libsandbox, move it out of libsbutil. Leave a note behind for possible future macros too. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: move verbose startup info behind debug knobMike Frysinger2021-11-051-8/+8
| | | | | | | These messages aren't super useful to most people, nor are needed on every invocation, so put them behind a debug knob to reduce log spam.x Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: add --debug option to control SANDBOX_DEBUGMike Frysinger2021-11-053-2/+15
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: restore SANDBOX_INTRACTV variableMike Frysinger2021-11-053-3/+7
| | | | | | | | I incorrectly dropped this as unused a while back, but the bashrc hook definitely still relies on it for checking portage settings. I think I got confused by the interaction with SANDBOX_TESTING. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: fix passing of config env vars downMike Frysinger2021-11-031-1/+1
| | | | | | | | | | This code has been buggy since it was first added years ago -- it would read the right value out of the config file, but then always just set $SANDBOX_VERBOSE to it instead of the right env var. This prevented the basic loading of sandbox settings from sandbox.conf. Bug: https://bugs.gentoo.org/821403 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: add backwards compat interface hackv2.29Mike Frysinger2021-11-021-0/+9
| | | | | | | | | | | | | | | | | Portage runs commands through sandbox like: $ sandbox "/usr/lib/portage/python3.9/ebuild.sh unpack" That means we can't break the CLI without breaking portage and forcing everyone to upgrade together. That'll be pretty disruptive for people, so add a hack to detect this situation: if a single argument is passed on the CLI, and it doesn't appear to be a file, then fallback to running it through the shell. This keeps portage working while allowing the new interface style to launch. If/when we can update portage to always use the -c option, maybe we can drop this in the future. Or not ... it's not exactly the worst hack for users. Bug: https://bugs.gentoo.org/265907 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: delete now unused variableMike Frysinger2021-11-011-1/+0
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: include "sandbox" in the error log summaryMike Frysinger2021-11-011-1/+1
| | | | | | | This should make it a little more clear that this summary is coming from the sandbox and not somewhere else. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: change interface to make it easier to pass thruMike Frysinger2021-10-283-20/+35
| | | | | | | | | | | The sandbox command line is passed to a shell for execution. This can be a bit awkward to quote right if you weren't expecting it, and even if you were. Change the default behavior to be more like `env` where the arguments, as they are, get passed through and run. If people want the old shell behavior, they can use the -c option akin to `bash -c`. Bug: https://bugs.gentoo.org/265907 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: avoid repetitive strlen calculations when building cmdlineMike Frysinger2021-10-281-11/+9
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: undefine dprintfMike Frysinger2021-10-281-0/+3
| | | | | | | The C library has a dprintf function too, and it might be a define that clashes with ours, so undefine it to avoid warnings. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: leverage PR_SET_NO_NEW_PRIVS when availablev2.27Mike Frysinger2021-10-231-0/+16
| | | | | | | | This will lock down the ability to use set*id programs (like sudo), and will allow us to utilize seccomp bpf to speed up ptrace. Closes: https://bugs.gentoo.org/442172 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: add a --run-configure optionMike Frysinger2021-10-232-10/+20
| | | | | | | | | When setting up sandbox on a new system for development, it helps to be able to build the new sandbox checkout in the same way as it is currently installed in the system. Add a command line option for this explicitly to speed up development. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* build: hoist -Itop_srcdir to common AM_CPPFLAGSMike Frysinger2021-10-231-1/+0
| | | | | | | Every subdir sets this var this way, so might as well unify it. We keep very few files in here, so shouldn't be a future problem. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Revert "Remove leftover generated Makefiles from the repo (sic!)"Mike Frysinger2021-10-221-0/+4
| | | | | | | This reverts commit 53ffbaeb24f6ee22a2dcd70fad29c86a4dd863c2. These files are supposed to be in here. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Remove leftover generated Makefiles from the repo (sic!)Michał Górny2021-10-221-4/+0
| | | | Signed-off-by: Michał Górny <mgorny@gentoo.org>
* switch to https:// URIs when possibleMike Frysinger2021-10-212-3/+3
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* build: flatten build a bit to avoid (most) recursive makeMike Frysinger2021-10-213-17/+19
| | | | | | Provides a bit of a speed up. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* namespaces: add support for cgroup & timeMike Frysinger2021-10-213-8/+30
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: add SANDBOX_METHOD settingMike Frysinger2021-10-181-0/+3
| | | | | | | | | | This allows people to disable use of ptrace if their configuration does not support it. This forces older sandbox behavior where we cannot protect against static or set*id programs. Bug: https://bugs.gentoo.org/648516 Bug: https://bugs.gentoo.org/771360 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: allow user to force SIGKILLMike Frysinger2016-03-291-2/+10
| | | | | | | Sometimes the child process can get wedged and not respond to CTRL+C, so add an escape hatch so the user can easily force SIGKILL. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: enable support for linux namespacesv2.9Mike Frysinger2015-09-275-1/+306
| | | | | | | | This initial version doesn't enable their use by default. URL: https://bugs.gentoo.org/512794 Reported-by: Matthew Thode <prometheanfire@gentoo.org> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: add helpers for reading config options (w/out env export)Mike Frysinger2015-09-262-0/+8
| | | | | | | | | All sandbox settings thus far have been for libsandbox.so to process. With newer features though, we have settings that might only apply to the main sandbox program. Add some helper functions for parsing out those settings (which a later commit will utilize). Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: add proper option parsingMike Frysinger2015-09-204-40/+125
| | | | | | This lays the groundwork for adding more runtime options. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: pass child signals back up to the parentMike Frysinger2013-02-221-24/+48
| | | | | | | | We were incorrectly passing signal information back up to the parent. See the URL for more information. URL: http://www.cons.org/cracauer/sigint.html Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: do not resolve target of stderrMike Frysinger2013-02-241-4/+7
| | | | | | | | | The recent e12fee192ac8b0343a468e5a8f7811a7b029ff9a commit does not handle things when stderr is connected to a real file (e.g. a pipe or a socket or fifo or ...). It also does not play well to have multiple things writing to the same file through different fds. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* add a new message env varMike Frysinger2013-02-243-2/+17
| | | | | | | | | | | | | | | | | | | | | | | | This is used whenever sandbox wants to display an informational message. For example, early notification of a path violation, or debugging output. We can't just pop open an fd and pass that around as apps consider that leakage and will often break assumptions in terms of free fds. Or apps that start up and cleanse all of their open fds. So instead, we just pass around an env var that holds the full path to the file we want will write to. Since these messages are infrequent (compared to overall runtime), opening/writing/closing the path every time is fine. This also avoids all the problems associated with using external portage helpers for writing messages. A follow up commit will take care of the situation where apps (such as scons) attempt to also cleanse the env before forking. URL: http://bugs.gentoo.org/278761 URL: http://bugs.gentoo.org/431638 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* delete unused sandbox env varsMike Frysinger2013-02-243-9/+3
| | | | | | Nothing uses or cares about these vars, so punt them. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* environ: add a new is_env_var helper for checking var namesMike Frysinger2013-02-241-2/+2
| | | | | | | This is laying the ground work for processing more vars in the future than just LD_PRELOAD. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: allow log files to fallback to tmpdirMike Frysinger2012-12-241-2/+2
| | | | | | | | Since non-root users typically do not have write access to /var/log, allow it to fallback to standard tmpdirs. This makes testing locally a lot easier. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* significantly overhaul output helpersMike Frysinger2012-06-232-16/+7
| | | | | | | | | | | | | | | | | | | | There are a few major points we want to hit here: - have all output from libsandbox go through portage helpers when we are in the portage environment so that output is properly logged - convert SB_E{info,warn,error} to sb_e{info,warn,error} to match style of other functions and cut down on confusion - move all abort/output helpers to libsbutil so it can be used in all source trees and not just by libsandbox - migrate all abort points to the centralized sb_ebort helper Unfortunately, it's not terribly easy to untangle these into separate patches, but hopefully this shouldn't be too messy as much of it is mechanical: move funcs between files, and change the name of funcs that get called. URL: http://bugs.gentoo.org/278761 Reported-by: Mounir Lamouri <volkmar@gentoo.org> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* tests: always bubble up exit code regardless of log existenceMike Frysinger2012-06-231-2/+3
| | | | | | | | | | | | To simplify testing, do not mung exit(0) to exit(1) just because the log file exists. In many of our tests, we will be doing things to generate a log file, but we explicitly test for exit values ourselves. This is also needed to make log file handling more resilient where we get the name at startup, but don't allow live env changes after that. The changing of the log name to sb.log on the fly no longer works. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: drop beep supportMike Frysinger2012-06-232-15/+1
| | | | | | | | Almost no one has beep support turned on anymore, and ebeep in the main tree has been deprecated (meaning it wasn't found useful while building packages). So punt support for it from sandbox too. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: push down constructor initMike Frysinger2012-03-051-0/+1
| | | | | | | | | | | | | | Since every consumer of sb_open gets a copy of the sbio_open data, push the init of this into the .data section of the respective consumers to avoid the runtime overhead. This just leaves sandbox_lib setup in the constructor function, but that is only needed by the execve wrapper, so push down init of that to the existing sb_init logic which happens before our execve wrapper gets used. URL: http://bugs.gentoo.org/404013 Reported-by: Mike Gilbert <floppym@gentoo.org> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: dont warn about inherited ignored signalsMike Frysinger2009-10-281-4/+4
| | | | | | | | | Inheriting signals are normal/fine, so don't warn about those since they aren't a problem. URL: http://bugs.gentoo.org/285341 Reported-by: Paul Varner <fuzzyray@gentoo.org> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsbutil: kill off unnecessary log_domain codeMike Frysinger2009-08-251-3/+0
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* drop force pic flagsMike Frysinger2009-08-251-2/+1
| | | | | | | The autotool build system already adds PIC where needed, so don't force our own -D/-f options. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* add -Wall to automake runs and fix falloutMike Frysinger2009-08-251-5/+3
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* setup local sandbox.d for running tests to avoid /etc/sandbox.dMike Frysinger2009-04-261-1/+2
| | | | | | | Always use local sandbox.d copy to avoid random /etc/sandbox.d issues like it doesn't exist, or has permission problems, or anything else. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox: enable tracing for multiple personalitiesMike Frysinger2009-04-051-0/+4
| | | | | | | | | Initial support for tracing non-default personalities. For example, tracing a 32bit binary from a 64bit environment. URL: http://bugs.gentoo.org/264399 Signed-off-by: Mike Frysinger <vapier@gentoo.org> Reported-by: Patrick Lauer <patrick@gentoo.org>
* sandbox: stop denying /etc/ld.so.preloadMike Frysinger2009-03-311-2/+0
| | | | | | | | The very old method of loading sandbox was via ld.so.preload, so it was added to default deny list. However, that's long dead, and since it does not conflict with LD_PRELOAD, no point in preventing access. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: don't put duplicate sandbox.so into LD_PRELOADv1.6Mike Frysinger2009-03-121-11/+15
| | | | | | | | | If launching another sandbox instance, don't blindly append LD_PRELOAD with the sandbox lib. URL: http://bugs.gentoo.org/216942 Signed-off-by: Mike Frysinger <vapier@gentoo.org> Reported-by: Brian Harring <ferringb@gmail.com>
* sandbox: pass shell exit status upMike Frysinger2009-03-121-13/+11
| | | | | | | If the command sandbox was instructed to execute failed, make sure we pass that exact exit status back up instead of normalizing everything to 0/1. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: delete the testing var after installv1.4Mike Frysinger2009-03-082-1/+9
| | | | | | | We don't want people to bypass normal mechanisms with the testing var, so zero out the name when installing the sandbox binary. Signed-off-by: Mike Frysinger <vapier@gentoo.org>