src/libcaptive/sandbox/split.c

   1 /* $Id$
   2  * Connection of captive-vfs interface through CORBA/ORBit
   3  * Copyright (C) 2002-2005 Jan Kratochvil <project-captive@jankratochvil.net>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; exactly version 2 of June 1991 is required
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  17  */
  18
  19
  20 #include "config.h"
  21
  22 #include "split.h"      /* self */
  23 #include "sandbox.h"
  24 #include "server-GLogFunc.h"
  25 #include "captive/macros.h"
  26 #include <glib/gmacros.h>
  27 #include <stdlib.h>
  28 #include "captive/rtl-file.h"
  29 #include <unistd.h>
  30 #include <fcntl.h>
  31 #include "server-Directory.h"
  32 #include "server-Vfs.h"
  33 #include "../client/vfs.h"
  34 #include "parent-Vfs.h"
  35 #include <dirent.h>
  36 #include "server-CaptiveIOChannel.h"
  37 #include <errno.h>
  38 #include "../client/giochannel-blind.h" /* for captive_giochannel_blind_new() */
  39 #include <signal.h>
  40 #include "../storage/relastblock.h"     /* for captive_storage_relastblock() */
  41 #include <sys/file.h>   /* flock() */
  42
  43 #ifdef HAVE_ORBIT_LINK
  44 void link_set_tmpdir(const char *dir);
  45 #else
  46 #include <linc/linc.h>  /* for linc_main_get_loop() */
  47 #endif
  48
  49
  50 /* CONFIG: */
  51
  52 #define HEARTBEAT_SOURCE_CHECK_EVENTS (G_IO_IN|G_IO_PRI)
  53 #define HEARTBEAT_SOURCE_CHECK_REVENTS (HEARTBEAT_SOURCE_CHECK_EVENTS|G_IO_ERR|G_IO_HUP|G_IO_NVAL)
  54
  55
  56 gboolean validate_CORBA_Environment(CORBA_Environment *evp)
  57 {
  58         if (evp->_major==CORBA_NO_EXCEPTION)
  59                 return TRUE;
  60
  61         g_error(_("CORBA Exception occured: id=\"%s\", value=%p"),
  62                         CORBA_exception_id(evp),CORBA_exception_value(evp));
  63         /* NOTREACHED */
  64         return FALSE;   /* GCC happiness. */
  65 }
  66
  67 CORBA_Environment captive_corba_ev;
  68 CORBA_ORB captive_corba_orb;
  69 PortableServer_POA captive_corba_poa;
  70
  71 static void corba_shutdown_atexit(void);
  72
  73 static gboolean corba_init(const char *pname,CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
  74 {
  75 static gboolean done=FALSE;
  76 int orb_argc=1;
  77 gchar *orb_argv[]={
  78                 (gchar *)captive_strdup_alloca(pname),
  79                 NULL};
  80
  81         g_return_val_if_fail(evp!=NULL,FALSE);
  82         g_return_val_if_fail(orbp!=NULL,FALSE);
  83         g_return_val_if_fail(poap!=NULL,FALSE);
  84
  85         if (done)
  86                 return TRUE;    /* FIXME: '*poap' is left invalid! */
  87
  88         /* Init 'ev' */
  89         CORBA_exception_init(evp);
  90
  91         /* Init 'orb' */
  92         /* libcaptive is single-threaded only, caller must lock it.
  93          * If thread A spawned the sandbox while currently doing its own work
  94          * and thread B calls the sandbox thread B waits on ORB_run()
  95          * while the sandbox waits for the response of thread A ORB. Deadlock.
  96          * "orbit-local-non-threaded-orb" requests thread unaware ORB.
  97          */
  98         *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-non-threaded-orb",evp);
  99         g_return_val_if_fail(*orbp!=CORBA_OBJECT_NIL,FALSE);
 100         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 101
 102         /* Init 'poa' */
 103         *poap=(PortableServer_POA)CORBA_ORB_resolve_initial_references(*orbp,"RootPOA",evp);
 104         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 105         {
 106 PortableServer_POAManager poa_mgr;
 107                 poa_mgr=PortableServer_POA__get_the_POAManager(*poap,evp);
 108                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 109                 PortableServer_POAManager_activate(poa_mgr,evp);
 110                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 111                 CORBA_Object_release((CORBA_Object)poa_mgr,evp);
 112                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 113                 }
 114
 115         g_atexit(corba_shutdown_atexit);
 116
 117         done=TRUE;
 118         return TRUE;
 119 }
 120
 121
 122 static CORBA_ORB heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 123
 124 gboolean corba_shutdown(CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
 125 {
 126 PortableServer_POA poa;
 127 CORBA_ORB orb;
 128
 129         g_return_val_if_fail(evp!=NULL,FALSE);
 130         g_return_val_if_fail(orbp!=NULL,FALSE);
 131         g_return_val_if_fail(poap!=NULL,FALSE);
 132
 133         /* Shutdown 'poa' */
 134         poa=*poap;
 135         *poap=CORBA_OBJECT_NIL;
 136         CORBA_Object_release((CORBA_Object)poa,evp);
 137         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 138
 139         /* Shutdown 'orb' */
 140         orb=*orbp;
 141         *orbp=CORBA_OBJECT_NIL;
 142         heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 143         CORBA_ORB_destroy(orb,evp);
 144         /* Do not: g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 145          * here as CORBA_ORB_destroy() sometimes reports:
 146          *      WARNING **: ORB: a total of X refs to X ORB objects were leaked
 147          */
 148         CORBA_exception_free(evp);
 149
 150         /* Shutdown 'ev' */
 151         CORBA_exception_free(evp);
 152
 153         return TRUE;
 154 }
 155
 156 static void sandbox_parent_own_orbit_dir_cleanup_atexit(void);
 157
 158 static void corba_shutdown_atexit(void)
 159 {
 160 gboolean errbool;
 161
 162         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 163         g_assert(errbool==TRUE);
 164
 165         /* Delete the CORBA ORB socket directory only after full CORBA ORB shutdown. */
 166         sandbox_parent_own_orbit_dir_cleanup_atexit();
 167 }
 168
 169
 170 static GSource *captive_corba_sandbox_child_heartbeat_gsource;
 171
 172 #if 0   /* Currently unused - see server-Vfs.c:impl_Captive_Vfs_shutdown() */
 173 void sandbox_child_prepare_shutdown(void)
 174 {
 175         /* Prevent during shutdown: Captive-WARNING **: CORBA Exception occured: id="IDL:omg.org/CORBA/COMM_FAILURE:1.0" */
 176         if (captive_corba_sandbox_child_heartbeat_gsource) {
 177                 g_source_destroy(captive_corba_sandbox_child_heartbeat_gsource);
 178                 g_source_unref(captive_corba_sandbox_child_heartbeat_gsource);
 179                 captive_corba_sandbox_child_heartbeat_gsource=NULL;
 180                 }
 181 }
 182 #endif
 183
 184 GMainLoop *captive_corba_get_loop(void)
 185 {
 186 #ifdef HAVE_ORBIT_LINK
 187 static GMainLoop *link_loop;
 188
 189         if (!link_loop)
 190                 link_loop=g_main_loop_new(g_main_context_default(),TRUE);
 191         return link_loop;
 192 #else
 193         return linc_main_get_loop();
 194 #endif
 195 }
 196
 197 GMainContext *captive_corba_get_context(void)
 198 {
 199         return g_main_loop_get_context(captive_corba_get_loop());
 200 }
 201
 202 void sandbox_child_shutdown(void)
 203 {
 204         /* Do not fail by passing logging messages to the master. */
 205         impl_Captive_Vfs_init_g_log_func_disable();
 206
 207         g_main_loop_quit(captive_corba_get_loop());
 208 }
 209
 210
 211 static gboolean heartbeat_source_callback(gpointer data /* unused */)
 212 {
 213         g_return_val_if_fail(heartbeat_source_callback_orb!=CORBA_OBJECT_NIL,FALSE);    /* the source should be removed */
 214
 215         sandbox_child_shutdown();
 216
 217         return FALSE;   /* the source should be removed */
 218 }
 219
 220
 221 static gboolean heartbeat_source_prepare(GSource *source,gint *timeout)
 222 {
 223         *timeout=-1;
 224
 225         return FALSE;
 226 }
 227
 228 static GPollFD heartbeat_source_check_gpollfd;
 229
 230 static gboolean heartbeat_source_check(GSource *source)
 231 {
 232         return !!(heartbeat_source_check_gpollfd.revents & HEARTBEAT_SOURCE_CHECK_REVENTS);
 233 }
 234
 235 static gboolean heartbeat_source_dispatch(GSource *source,GSourceFunc callback,gpointer user_data)
 236 {
 237         g_assert(callback!=NULL);
 238         return (*callback)(user_data);
 239 }
 240
 241 static GSourceFuncs heartbeat_source_watch_funcs={
 242                 heartbeat_source_prepare,
 243                 heartbeat_source_check,
 244                 heartbeat_source_dispatch,
 245                 NULL,   /* finalize */
 246                 };
 247
 248 void captive_corba_sandbox_child(const gchar *chrooted_orbit_dir)
 249 {
 250 Captive_Vfs Vfs_object;
 251 impl_POA_Captive_Vfs *Vfs_servant;
 252 gboolean errbool;
 253 guint errguint;
 254 int errint;
 255
 256         /* attach heartbeat_source_callback() to watch for any abnormalities
 257          * on our open pipe 'parentheart_fds' and terminate the child if parent dies.
 258          */
 259         captive_corba_sandbox_child_heartbeat_gsource=g_source_new(&heartbeat_source_watch_funcs,sizeof(GSource));
 260         g_return_if_fail(captive_corba_sandbox_child_heartbeat_gsource!=NULL);
 261         g_source_set_callback(
 262                         captive_corba_sandbox_child_heartbeat_gsource,  /* source */
 263                         heartbeat_source_callback,      /* func */
 264                         NULL,   /* data */
 265                         NULL);  /* notify */
 266         heartbeat_source_check_gpollfd.fd=0 /* STDIN */;        /* parentheart_fd_read */
 267         heartbeat_source_check_gpollfd.events=HEARTBEAT_SOURCE_CHECK_EVENTS;
 268         heartbeat_source_check_gpollfd.revents=0;
 269         g_source_add_poll(captive_corba_sandbox_child_heartbeat_gsource,&heartbeat_source_check_gpollfd);
 270
 271         errbool=corba_init("captive-sandbox-child",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 272         g_return_if_fail(errbool==TRUE);
 273
 274         heartbeat_source_callback_orb=captive_corba_orb;
 275
 276         /* captive_corba_get_context() makes sense only after corba_init() -> CORBA_ORB_init() */
 277         errguint=g_source_attach(
 278                         captive_corba_sandbox_child_heartbeat_gsource,  /* source */
 279                         captive_corba_get_context());   /* context; NULL means 'default context' */
 280         g_assert(errguint!=0);
 281
 282         /* Init 'Vfs_object' */
 283         Vfs_object=impl_Captive_Vfs__create(captive_corba_poa,&captive_corba_ev);
 284         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 285
 286         /* Pass IOR to our parent.
 287          * It will also create the socket needed for 'chrooted_orbit_dir' below
 288          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 289          */
 290         {
 291 char *Vfs_IOR;
 292                 Vfs_IOR=CORBA_ORB_object_to_string(captive_corba_orb,Vfs_object,&captive_corba_ev);
 293                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 294                 g_assert(Vfs_IOR!=NULL);
 295                 errint=printf("ior=%s\n",Vfs_IOR);
 296                 g_assert(errint>=0);
 297                 CORBA_free(Vfs_IOR);
 298                 }
 299
 300         /* Default mode is 0700, permit parent non-"captive" users to access our IOR socket. */
 301         if (chrooted_orbit_dir) {
 302 DIR *dir;
 303 struct dirent *dirent;
 304 const gchar *socketname=NULL,*socketpathname;
 305
 306                 errint=chmod(chrooted_orbit_dir,0755);
 307                 g_assert(errint==0);
 308
 309                 dir=opendir(chrooted_orbit_dir);
 310                 g_assert(dir!=NULL);
 311                 while (errno=0,(dirent=readdir(dir))) {
 312                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 313                                 continue;
 314                         g_assert(socketname==NULL);
 315                         socketname=captive_strdup_alloca(dirent->d_name);
 316                         }
 317                 g_assert(errno==0);
 318                 errint=closedir(dir);
 319                 g_assert(errint==0);
 320                 g_assert(socketname!=NULL);
 321
 322                 socketpathname=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
 323                 errint=chmod(socketpathname,0666);
 324                 g_assert(errint==0);
 325
 326                 printf("socketname=%s\n",socketname);
 327                 }
 328
 329         /* Close the output to flush it to our spawning parent. */
 330         errint=fflush(stdout);
 331         g_assert(errint==0);
 332         errint=fclose(stdout);
 333         g_assert(errint==0);
 334
 335         /* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
 336          * and therefore we should be safe with glib events handling.
 337          */
 338 #ifdef HAVE_ORBIT_LINK
 339         g_main_loop_run(captive_corba_get_loop());
 340 #else
 341         CORBA_ORB_run(captive_corba_orb,&captive_corba_ev);
 342         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 343 #endif
 344
 345         /* Shutdown 'Vfs' servant */
 346         Vfs_servant=PortableServer_POA_reference_to_servant(captive_corba_poa,Vfs_object,&captive_corba_ev);
 347         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 348         CORBA_Object_release(Vfs_object,&captive_corba_ev);
 349         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 350         impl_Captive_Vfs__destroy(Vfs_servant,&captive_corba_ev);
 351         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 352
 353         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 354         g_assert(errbool==TRUE);
 355
 356         _exit(EXIT_SUCCESS);
 357 }
 358
 359
 360 static void options_module_captive_to_options_module_corba
 361                 (Captive_CaptiveOptionsModule *dest_options_module_corba,const struct captive_options_module *src_options_module_captive)
 362 {
 363         g_return_if_fail(dest_options_module_corba!=NULL);
 364         g_return_if_fail(src_options_module_captive!=NULL);
 365
 366         g_return_if_fail(src_options_module_captive->type==CAPTIVE_OPTIONS_MODULE_TYPE_PE32);
 367
 368         dest_options_module_corba->pathname_utf8=CORBA_string_dup(src_options_module_captive->pathname_utf8);
 369         dest_options_module_corba->data._maximum=src_options_module_captive->u.pe32.length;
 370         dest_options_module_corba->data._length =src_options_module_captive->u.pe32.length;
 371         dest_options_module_corba->data._buffer=Captive_Bytes_allocbuf(dest_options_module_corba->data._maximum);
 372         memcpy(dest_options_module_corba->data._buffer,src_options_module_captive->u.pe32.base,
 373                         src_options_module_captive->u.pe32.length);
 374         dest_options_module_corba->data._release=TRUE;
 375 }
 376
 377 static void unlink_nonrecursive(const gchar *dirname)
 378 {
 379 DIR *dir;
 380 struct dirent *dirent;
 381 int errint;
 382
 383         if (!(dir=opendir(dirname)))
 384                 g_error(_("Failed to check for non-recursive removal directory \"%s\": %m"),dirname);
 385
 386         while (errno=0,(dirent=readdir(dir))) {
 387 gchar *pathname;
 388
 389                 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 390                         continue;
 391                 pathname=g_strdup_printf("%s/%s",dirname,dirent->d_name);
 392                 errint=unlink(pathname);
 393                 g_assert(errint==0);
 394                 g_free(pathname);
 395                 }
 396         g_assert(errno==0);
 397         errint=closedir(dir);
 398         g_assert(errint==0);
 399         if (rmdir(dirname))
 400                 g_error(_("Failed to remove (non-recursive removal) directory \"%s\": %m"),dirname);
 401 }
 402
 403 static const gchar *sandbox_parent_own_orbit_dir;
 404 static const gchar *sandbox_parent_own_orbit_socket;
 405
 406 static void sandbox_parent_own_orbit_dir_cleanup_atexit(void)
 407 {
 408 static gboolean done=FALSE;
 409
 410         g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s; done=%d",G_STRLOC,(int)done);
 411
 412         if (done)
 413                 return;
 414         done=TRUE;
 415
 416         if (sandbox_parent_own_orbit_dir)
 417                 unlink_nonrecursive(sandbox_parent_own_orbit_dir);
 418 }
 419
 420 static struct sandbox_parent_own_orbit_dir_cleanup_signal {
 421         int signum;
 422         /* FIXME: Why we cannot use 'sighandler_t'? */ void (*sighandler_orig)(int signum);
 423         } sandbox_parent_own_orbit_dir_cleanup_signals[]={
 424                 { SIGINT  },
 425                 { SIGQUIT },
 426                 { SIGTERM },
 427                 { SIGHUP  },
 428                 { SIGABRT },
 429                 { SIGFPE  },
 430                 };
 431
 432 static void sandbox_parent_own_orbit_dir_cleanup_sighandler(int signum)
 433 {
 434 struct sandbox_parent_own_orbit_dir_cleanup_signal *sigstructp;
 435
 436         for (
 437                         sigstructp=sandbox_parent_own_orbit_dir_cleanup_signals;
 438                         sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals);
 439                         sigstructp++) {
 440                 if (sigstructp->signum==signum)
 441                         break;
 442                 }
 443         g_assert(sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals));
 444         signal(signum,sigstructp->sighandler_orig);
 445
 446         /* Prevent recursive fatal logging before signal restore: */
 447         /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: signum=%d,sighandler_orig=%p",G_STRLOC,signum,sigstructp->sighandler_orig);
 448          * as it is dangerous to g_log() from sighandler.
 449          */
 450
 451         sandbox_parent_own_orbit_dir_cleanup_atexit();
 452
 453         /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: re-raising...",G_STRLOC);
 454          * as it is dangerous to g_log() from sighandler.
 455          */
 456         raise(signum);
 457 }
 458
 459 static void sandbox_parent_own_orbit_dir_cleanup_init(void)
 460 {
 461 struct sandbox_parent_own_orbit_dir_cleanup_signal *sigstructp;
 462
 463         for (
 464                         sigstructp=sandbox_parent_own_orbit_dir_cleanup_signals;
 465                         sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals);
 466                         sigstructp++) {
 467                 sigstructp->sighandler_orig=signal(sigstructp->signum,sandbox_parent_own_orbit_dir_cleanup_sighandler);
 468                 if (sigstructp->sighandler_orig==SIG_IGN)
 469                         sigstructp->sighandler_orig=SIG_DFL;
 470                 }
 471 }
 472
 473 static void createlockdir(const gchar *dir)
 474 {
 475 gint retries;
 476
 477         for (retries=0;retries<10;retries++) {
 478 struct stat statbuf;
 479 int dirfd;
 480
 481                 if (mkdir(dir,0700)) {
 482                         if (errno!=EEXIST)
 483                                 g_error(_("Failed to create chroot directory \"%s\": %m"),dir);
 484                         unlink_nonrecursive(dir);
 485                         if (mkdir(dir,0700))
 486                                 g_error(_("Failed to create chroot directory \"%s\" after attempted unlink: %m"),dir);
 487                         }
 488                 dirfd=open(dir,O_RDONLY);
 489                 if (dirfd==-1) {
 490                         if (errno!=ENOENT)
 491                                 g_error(_("Failed to open created chroot directory \"%s\" to lock it: %m"),dir);
 492                         continue;
 493                         }
 494                 /* Do not use 'LOCK_NB' here as the garbage collector should release it soon. */
 495                 if (flock(dirfd,LOCK_EX))
 496                         g_error(_("Failed to lock created chroot directory \"%s\": %m"),dir);
 497                 if (lstat(dir,&statbuf)) {
 498                         if (errno!=ENOENT)
 499                                 g_error(_("Failed to lstat(2) created chroot directory \"%s\": %m"),dir);
 500                         if (close(dirfd))
 501                                 g_error(_("Failed to close created and locked chroot directory \"%s\": %m"),dir);
 502                         continue;
 503                         }
 504                 /* Leave 'dirfd' open to leave it LOCK_EX-ed. */
 505                 break;
 506                 }
 507 }
 508
 509 static gchar *sandbox_parent_read_ior
 510                 (int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp,CaptiveVfsParentObject *captive_vfs_parent_object)
 511 {
 512 gchar *data;
 513 gsize data_size;
 514 GHashTable *hash;
 515 gchar *ior,*child_chroot_pid_hashkey_dir;
 516 int errint;
 517 gchar *s,*sd,*se;
 518 gboolean errbool;
 519 const gchar *ior_read_error;
 520
 521         /* Initialize /tmp/orbit-$username directory for linking IOR socket. */
 522         errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 523         g_assert(errbool==TRUE);
 524
 525         /* FIXME: Security: Duplicate giop_tmpdir_init() here. */
 526         if (!sandbox_parent_own_orbit_dir) {
 527                 /* FIXME: Make 'CAPTIVE_SANDBOX_CHROOT' configurable. */
 528                 /* Use also geteuid() marker here as could not remove the directory
 529                  * of some other user otherwise.
 530                  */
 531                 sandbox_parent_own_orbit_dir=g_strdup_printf("%s/tmp/captive-orbit-%d-%d",CAPTIVE_SANDBOX_CHROOT,getpid(),geteuid());
 532                 sandbox_parent_own_orbit_dir_cleanup_init();
 533                 createlockdir(sandbox_parent_own_orbit_dir);
 534 #ifdef HAVE_ORBIT_LINK
 535                 link_set_tmpdir(sandbox_parent_own_orbit_dir);
 536 #else
 537                 linc_set_tmpdir(sandbox_parent_own_orbit_dir);
 538 #endif
 539                 }
 540
 541         data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
 542         errint=close(Vfs_IOR_fd_read);
 543         ior_read_error=NULL;
 544 #define IOR_READ_ERROR(cond) G_STMT_START { \
 545                 if (!ior_read_error && !(cond)) \
 546                         ior_read_error=G_STRINGIFY(cond); \
 547                 } G_STMT_END
 548         IOR_READ_ERROR(errint==0);
 549         IOR_READ_ERROR(data!=NULL);
 550         IOR_READ_ERROR(data_size>=1);
 551         IOR_READ_ERROR(data[data_size-1]=='\n');
 552         if (ior_read_error)
 553                 g_error(_("Error connecting to the sandbox server (failed \"%s\"). Try running by hand: %s"),
 554                                 ior_read_error,CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0]);
 555 #undef IOR_READ_ERROR
 556
 557         hash=g_hash_table_new(g_str_hash,g_str_equal);
 558
 559         for (s=data;s<data+data_size;s=se+1) {
 560                 se=strchr(s,'\n');
 561                 g_assert(se!=NULL);
 562                 *se=0;
 563                 sd=strchr(s,'=');
 564                 g_assert(sd!=NULL);
 565                 *sd=0;
 566                 g_hash_table_insert(hash,s,sd+1);
 567                 }
 568         g_assert(s==data+data_size);
 569
 570         if ((child_chroot_pid_hashkey_dir=g_hash_table_lookup(hash,"chroot_pid_hashkey_dir"))) {
 571 const gchar *socketname,*socketpathname_src,*socketpathname_dest;
 572 const gchar *chrooted_orbit_dir;
 573
 574                 /* IOR contains the full pathname with the setuid username encoded. */
 575                 chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
 576                 g_assert(chrooted_orbit_dir!=NULL);
 577                 captive_vfs_parent_object->corba_chrooted_orbit_dir=g_strdup(chrooted_orbit_dir);
 578                 /* 0700 as this directory will not be reused
 579                  * to commuicate with any other sandbox child.
 580                  */
 581                 if (mkdir(chrooted_orbit_dir,0700)) {
 582                         g_assert(errno==EEXIST);
 583                         }
 584
 585                 socketname=g_hash_table_lookup(hash,"socketname");
 586                 g_assert(socketname!=NULL);
 587                 captive_vfs_parent_object->corba_socketname=g_strdup(socketname);
 588
 589                 socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
 590                 socketpathname_dest=g_strdup_printf("%s/%s",chrooted_orbit_dir,socketname);
 591                 errint=link(socketpathname_src,socketpathname_dest);
 592                 if (errint)
 593                         g_error("link(\"%s\",\"%s\")=%d:%m",socketpathname_src,socketpathname_dest,errint);
 594                 }
 595         if (child_chroot_pid_hashkey_dirp)
 596                 *child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
 597
 598         ior=g_hash_table_lookup(hash,"ior");
 599         g_assert(ior!=NULL);
 600         ior=g_strdup(ior);
 601         g_free(data);
 602
 603         g_hash_table_destroy(hash);
 604
 605         return ior;
 606 }
 607
 608
 609 static xmlNode *options_module_captive_to_xml
 610                 (xmlNode *dest_xml_parent,const struct captive_options_module *src_options_module_captive)
 611 {
 612         g_return_val_if_fail(dest_xml_parent!=NULL,NULL);
 613         g_return_val_if_fail(src_options_module_captive!=NULL,NULL);
 614
 615         { xmlNode *module=xmlNewTextChild(dest_xml_parent,NULL,BAD_CAST "module",NULL);
 616         const gchar *type_string="???"; /* Prevent: ... might be used uninitialized in this function */
 617         const gchar *basename,*cgs;
 618
 619                 basename=src_options_module_captive->pathname_utf8;
 620                 if ((cgs=strrchr(basename,'/')))
 621                         basename=cgs+1;
 622                 xmlNewProp(module,BAD_CAST "basename",BAD_CAST basename);
 623                 switch (src_options_module_captive->type) {
 624                         case CAPTIVE_OPTIONS_MODULE_TYPE_PE32:
 625                                 type_string="PE32";
 626                                 xmlNewProp(module,BAD_CAST "length",BAD_CAST captive_printf_alloca("%lu",(unsigned long)src_options_module_captive->u.pe32.length));
 627                                 xmlNewProp(module,BAD_CAST "md5"   ,BAD_CAST src_options_module_captive->u.pe32.md5);
 628                                 break;
 629                         case CAPTIVE_OPTIONS_MODULE_TYPE_GMODULE:
 630                                 type_string="gmodule";
 631                                 break;
 632                         default: g_assert_not_reached();
 633                         }
 634                 xmlNewProp(module,BAD_CAST "type",BAD_CAST type_string);        /* AFTER the 'switch' to set 'type_string'! */
 635                 return module;
 636                 }
 637 }
 638
 639
 640 static void sandbox_parent_bug_doc_make(CaptiveVfsParentObject *captive_vfs_parent_object)
 641 {
 642         { xmlDoc *doc=xmlNewDoc(BAD_CAST "1.0");
 643                 captive_vfs_parent_object->corba_bug_doc=doc;
 644                 { xmlNode *bug=xmlNewDocNode(captive_vfs_parent_object->corba_bug_doc,NULL,BAD_CAST "bug",NULL);
 645                         xmlDocSetRootElement(captive_vfs_parent_object->corba_bug_doc,bug);
 646                         captive_vfs_parent_object->corba_bug=bug;
 647                         { xmlNode *bug_captive=xmlNewTextChild(bug,NULL,BAD_CAST "captive",NULL);
 648                                 xmlNewProp(bug_captive,BAD_CAST "version",BAD_CAST VERSION);
 649                                 }
 650                         { xmlNode *bug_filesystem=xmlNewTextChild(bug,NULL,BAD_CAST "filesystem",NULL);
 651                                 options_module_captive_to_xml(bug_filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
 652                                 }
 653                         { xmlNode *bug_load_module=xmlNewTextChild(bug,NULL,BAD_CAST "load_module",NULL);
 654                         guint load_moduleui;
 655                         struct captive_options_module *options_module;
 656                         GList *load_module_node;
 657
 658                                 for (load_moduleui=0,load_module_node=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module;
 659                                                 load_module_node;
 660                                                 load_moduleui++,load_module_node=load_module_node->next) {
 661                                         options_module=load_module_node->data;
 662                                         options_module_captive_to_xml(bug_load_module,options_module);
 663                                         }
 664                                 }
 665                         { xmlNode *bug_action=xmlNewTextChild(bug,NULL,BAD_CAST "action",NULL);
 666                                 captive_vfs_parent_object->corba_bug_action=bug_action;
 667                                 }
 668                         { xmlNode *bug_log=xmlNewTextChild(bug,NULL,BAD_CAST "log",NULL);
 669                                 captive_vfs_parent_object->corba_bug_log=bug_log;
 670                                 }
 671                         }
 672                 }
 673 }
 674
 675
 676 static void sandbox_parent(const gchar *Vfs_IOR,const gchar *child_chroot_pid_hashkey_dir,CaptiveVfsParentObject *captive_vfs_parent_object)
 677 {
 678 Captive_Vfs Vfs_object;
 679 Captive_GLogFunc GLogFunc_object;
 680 Captive_CaptiveIOChannel CaptiveIOChannel_object;
 681 Captive_CaptiveOptions options_corba;
 682 guint load_module_length,load_moduleui;
 683 struct captive_options_module *options_module;
 684 GList *load_module_node;
 685 const gchar *child_chroot_parent_own_orbit_socket,*child_chroot_parent_own_orbit_dir;
 686 int errint;
 687
 688         g_return_if_fail(Vfs_IOR!=NULL);
 689         /* 'child_chroot_pid_hashkey_dir' may be NULL */
 690         g_return_if_fail(CAPTIVE_VFS_PARENT_IS_OBJECT(captive_vfs_parent_object));
 691
 692         Vfs_object=CORBA_ORB_string_to_object(captive_corba_orb,Vfs_IOR,&captive_corba_ev);
 693         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 694
 695         /* Init 'GLogFunc_object' */
 696         GLogFunc_object=impl_Captive_GLogFunc__create(captive_corba_poa,captive_vfs_parent_object,&captive_corba_ev);
 697         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 698
 699         /* Init 'CaptiveIOChannel_object' */
 700         if (!captive_vfs_parent_object->corba_parent_giochanel_blind_source) {
 701 GIOChannel *giochannel;
 702
 703                 giochannel=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.image_iochannel;
 704                 g_io_channel_ref(giochannel);
 705
 706                 giochannel=captive_storage_relastblock(giochannel);
 707
 708                 switch (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode) {
 709                         case CAPTIVE_OPTION_RWMODE_RO:
 710                         case CAPTIVE_OPTION_RWMODE_RW:
 711                                 break;
 712                         case CAPTIVE_OPTION_RWMODE_BLIND: {
 713 GIOChannel *giochannel_orig;
 714
 715                                 giochannel_orig=giochannel;
 716                                 giochannel=(GIOChannel *)captive_giochannel_blind_new(
 717                                                 giochannel,     /* giochannel_orig */
 718                                                 TRUE); /* writeable */
 719                                 g_io_channel_unref(giochannel_orig);    /* reffed by captive_giochannel_blind_new() */
 720                                 } break;
 721                         default: g_assert_not_reached();
 722                         }
 723                 captive_vfs_parent_object->corba_parent_giochanel_blind_source=giochannel;
 724                 }
 725
 726         if (!captive_vfs_parent_object->corba_parent_giochanel_blind)
 727                 captive_vfs_parent_object->corba_parent_giochanel_blind=(GIOChannel *)captive_giochannel_blind_new(
 728                                 captive_vfs_parent_object->corba_parent_giochanel_blind_source,  /* giochannel_orig */
 729                                 (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode!=CAPTIVE_OPTION_RWMODE_RO)); /* writeable */
 730         CaptiveIOChannel_object=impl_Captive_CaptiveIOChannel__create(captive_corba_poa,
 731                         captive_vfs_parent_object->corba_parent_giochanel_blind,&captive_corba_ev);
 732         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 733
 734         /* Create the socket needed for 'sandbox_parent_own_orbit_socket' below
 735          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 736          */
 737         {
 738 char *GLogFunc_IOR;
 739                 GLogFunc_IOR=CORBA_ORB_object_to_string(captive_corba_orb,GLogFunc_object,&captive_corba_ev);
 740                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 741                 g_assert(GLogFunc_IOR!=NULL);
 742                 CORBA_free(GLogFunc_IOR);
 743                 }
 744
 745         if (sandbox_parent_own_orbit_dir && !sandbox_parent_own_orbit_socket) {
 746 DIR *dir;
 747 struct dirent *dirent;
 748
 749                 dir=opendir(sandbox_parent_own_orbit_dir);
 750                 g_assert(dir!=NULL);
 751
 752                 while (errno=0,(dirent=readdir(dir))) {
 753                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 754                                 continue;
 755                         g_assert(sandbox_parent_own_orbit_socket==NULL);
 756                         sandbox_parent_own_orbit_socket=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
 757                         }
 758                 g_assert(errno==0);
 759                 errint=closedir(dir);
 760                 g_assert(errint==0);
 761                 g_assert(sandbox_parent_own_orbit_socket!=NULL);
 762                 }
 763
 764         if (child_chroot_pid_hashkey_dir) {
 765 gchar *s;
 766
 767                 child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
 768                 s=(/* de-const */ gchar *)child_chroot_parent_own_orbit_dir;
 769                 do {
 770                         s=strchr(s,'/');
 771                         if (s)
 772                                 *s=0;
 773                         if (*child_chroot_parent_own_orbit_dir) {
 774                                 errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
 775                                 if (errint)
 776                                         g_assert(errno==EEXIST);
 777                                 else {
 778                                         /* chmod(2) it to prevent mode limitation by
 779                                          * active ulimit(2) of being executed by mount(8).
 780                                          */
 781                                         errint=chmod(child_chroot_parent_own_orbit_dir,0777);
 782                                         g_assert(errint==0);
 783                                         }
 784                                 }
 785                         if (s)
 786                                 *s++='/';
 787                         } while (s);
 788                 child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
 789                                 child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
 790                 errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
 791                 g_assert(errint==0);
 792                 /* chmod(2)s also our orig. one (!) but this one is protected by its 0777 directory. */
 793                 errint=chmod(child_chroot_parent_own_orbit_socket,0666);
 794                 g_assert(errint==0);
 795                 }
 796
 797         options_corba.g_log_func=CORBA_Object_duplicate(GLogFunc_object,&captive_corba_ev);
 798         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 799
 800         options_module_captive_to_options_module_corba(&options_corba.filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
 801         /* Prevent secondary captive_giochannel_blind inside of our sandbox child
 802          * as we already have one captive_giochannel_blind in the parent.
 803          */
 804         options_corba.rwmode        =(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode == CAPTIVE_OPTION_RWMODE_BLIND ? CAPTIVE_OPTION_RWMODE_RW
 805                         : CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode);
 806         options_corba.media         =CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.media;
 807         options_corba.debug_messages=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.debug_messages;
 808
 809         options_corba.image_iochannel=CORBA_Object_duplicate(CaptiveIOChannel_object,&captive_corba_ev);
 810         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 811
 812         load_module_length=g_list_length(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module);
 813         options_corba.load_module._maximum=load_module_length;
 814         options_corba.load_module._length=load_module_length;
 815         options_corba.load_module._buffer=Captive_CaptiveOptionsModuleList_allocbuf(options_corba.load_module._maximum);
 816         options_corba.load_module._release=TRUE;
 817         for (load_moduleui=0,load_module_node=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module;
 818                         load_module_node;
 819                         load_moduleui++,load_module_node=load_module_node->next) {
 820                 options_module=load_module_node->data;
 821                 options_module_captive_to_options_module_corba(options_corba.load_module._buffer+load_moduleui,options_module);
 822                 }
 823
 824         Captive_Vfs_init(Vfs_object,&options_corba,&captive_corba_ev);
 825         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 826
 827         Captive_CaptiveOptions__freekids(&options_corba,
 828                         NULL);  /* d; unused */
 829
 830         captive_vfs_parent_object->corba_Vfs_object=Vfs_object;
 831         captive_vfs_parent_object->corba_GLogFunc_object=GLogFunc_object;
 832         captive_vfs_parent_object->corba_CaptiveIOChannel_object=CaptiveIOChannel_object;
 833
 834         if (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.bug_pathname)
 835                 sandbox_parent_bug_doc_make(captive_vfs_parent_object);
 836 }
 837
 838 static void fd_shiftup(int *fdp)
 839 {
 840         g_return_if_fail(fdp!=NULL);
 841
 842         while (*fdp<=2 /* STDERR */) {
 843                 *fdp=dup(*fdp);
 844                 g_assert(*fdp!=-1);
 845                 }
 846 }
 847
 848 void captive_sandbox_fd_closeup(int fd_first_to_delete)
 849 {
 850 DIR *dir;
 851 int errint;
 852 int dir_fd;
 853 struct dirent *dirent;
 854
 855         dir=opendir("/proc/self/fd/");
 856         g_return_if_fail(dir!=NULL);
 857         dir_fd=dirfd(dir);
 858         g_return_if_fail(dir_fd!=-1);
 859
 860         while (errno=0,(dirent=readdir(dir))) {
 861 long dirent_fd;
 862 char *endptr;
 863
 864                 if (0
 865                                 || !strcmp(dirent->d_name,".")
 866                                 || !strcmp(dirent->d_name,".."))
 867                         continue;
 868                 dirent_fd=strtol(dirent->d_name,&endptr,10 /* base */);
 869                 g_assert(dirent_fd>=0 && (!endptr || !*endptr));
 870                 if (dirent_fd<fd_first_to_delete || dirent_fd==dir_fd)
 871                         continue;
 872
 873                 errint=close(dirent_fd);
 874                 g_assert(errint==0);
 875                 errno=0;
 876                 errint=close(dirent_fd);
 877                 g_assert(errint==-1); g_assert(errno==EBADF);
 878                 }
 879         g_return_if_fail(errno==0);     /* check for EOF */
 880
 881         errint=closedir(dir);
 882         g_return_if_fail(errint==0);
 883         errno=0;
 884         close(dir_fd); g_assert(errno==EBADF);  /* just a bit of paranoia; it should be already closed by closedir() */
 885 }
 886
 887 gboolean captive_sandbox_spawn(CaptiveVfsParentObject *captive_vfs_parent_object)
 888 {
 889 /* Vfs_IOR_fds[0] for reading by sandbox_parent() - client,
 890  * Vfs_IOR_fds[1] for writing by sandbox_child()  - server
 891  */
 892 int Vfs_IOR_fds[2],parentheart_fds[2];
 893 int errint;
 894 gboolean errbool;
 895
 896         g_return_val_if_fail(CAPTIVE_VFS_PARENT_IS_OBJECT(captive_vfs_parent_object),FALSE);
 897
 898         errint=pipe(Vfs_IOR_fds);
 899         g_return_val_if_fail(errint==0,FALSE);
 900         errint=pipe(parentheart_fds);
 901         g_return_val_if_fail(errint==0,FALSE);
 902
 903         /* Currently never called anywhere:
 904          *     errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 905          *     g_assert(errbool==TRUE);
 906          */
 907
 908         if (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior) {
 909                 g_assert(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv==NULL);
 910
 911                 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 912                 g_assert(errbool==TRUE);
 913
 914                 captive_vfs_parent_object->corba_parentheart_fds_1=-1;
 915                 captive_vfs_parent_object->corba_child_pid=-1;
 916                 sandbox_parent(
 917                                 CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior,      /* Vfs_IOR */
 918                                 NULL,   /* child_chroot_pid_hashkey_dir */
 919                                 captive_vfs_parent_object);     /* captive_vfs_parent_object */
 920                 return TRUE;
 921                 }
 922
 923         g_assert(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv!=NULL);
 924         switch ((captive_vfs_parent_object->corba_child_pid=fork())) {
 925                 case -1:        /* error */
 926                         g_return_val_if_reached(FALSE);
 927
 928                 case 0: { /* child */
 929 const char *sandbox_argv0;
 930 int execv_rc;
 931
 932                         errint=close(Vfs_IOR_fds[0]);   /* close Vfs_IOR_fd_read */
 933                         g_return_val_if_fail(errint==0,FALSE);
 934                         errint=close(parentheart_fds[1]);       /* close parentheart_fd_write */
 935                         g_return_val_if_fail(errint==0,FALSE);
 936
 937                         fd_shiftup(Vfs_IOR_fds+1);      /* Vfs_IOR_fd_write */
 938                         fd_shiftup(parentheart_fds+0);  /* parentheart_fd_read */
 939                         errint=dup2(Vfs_IOR_fds[1],1 /* STDOUT */);     /* Vfs_IOR_fd_write */
 940                         g_return_val_if_fail(errint==1 /* STDOUT */,FALSE);
 941                         errint=dup2(parentheart_fds[0],0 /* STDIN */);  /* parentheart_fd_read */
 942                         g_return_val_if_fail(errint==0 /* STDIN */,FALSE);
 943
 944                         captive_sandbox_fd_closeup(2 /* STDERR */ +1);
 945
 946                         sandbox_argv0=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0];
 947                         execv_rc=execv(sandbox_argv0,
 948                                         /* re-const */ (char * const *)CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv);
 949                         g_error(_("Failed to spawn sandbox server - execv(\"%s\",...)=%d: %m"),sandbox_argv0,execv_rc);
 950                         } /* NOTREACHED */
 951
 952                 default: {      /* parent */
 953 gchar *Vfs_IOR;
 954 gchar *child_chroot_pid_hashkey_dir;
 955
 956                         errint=close(Vfs_IOR_fds[1]);   /* close Vfs_IOR_fd_write */
 957                         g_return_val_if_fail(errint==0,FALSE);
 958                         errint=close(parentheart_fds[0]);       /* close parentheart_fd_read */
 959                         g_return_val_if_fail(errint==0,FALSE);
 960                         errint=fcntl(parentheart_fds[1],F_SETFD,FD_CLOEXEC);
 961                         /* This fcntl(2) may not be enough - some fork(2) may duplicate this
 962                          * write descriptor and even if we do some process finish the child
 963                          * may remain alone connected with some unknown fork(2)er from us.
 964                          * Currently I am not aware such case would occur.
 965                          */
 966                         g_return_val_if_fail(errint==0,FALSE);
 967                         captive_vfs_parent_object->corba_parentheart_fds_1=parentheart_fds[1];
 968
 969                         Vfs_IOR=sandbox_parent_read_ior(
 970                                         Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
 971                                         &child_chroot_pid_hashkey_dir,
 972                                         captive_vfs_parent_object);
 973
 974                         sandbox_parent(
 975                                         Vfs_IOR,        /* Vfs_IOR */
 976                                         child_chroot_pid_hashkey_dir,   /* child_chroot_pid_hashkey_dir */
 977                                         captive_vfs_parent_object);     /* captive_vfs_parent_object */
 978
 979                         g_free(Vfs_IOR);
 980                         g_free(child_chroot_pid_hashkey_dir);
 981
 982                         /* 'parentheart_fds[1]' - parentheart_fd_write - is left open here */
 983                         return TRUE;
 984                         }
 985                 }
 986         /* NOTREACHED */
 987         g_return_val_if_reached(FALSE);
 988 }
 989
 990
 991 GnomeVFSResult captive_sandbox_parent_return_from_CORBA_Environment
 992                 (CORBA_Environment *evp,CaptiveVfsParentObject *captive_vfs_parent_object)
 993 {
 994 GnomeVFSResult r;
 995
 996         if (evp->_major==CORBA_NO_EXCEPTION)
 997                 return GNOME_VFS_OK;
 998
 999         /* If !CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv it is CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior
1000          * where we cannot do any restart anyway.
1001          */
1002         if (captive_vfs_parent_object && CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv
1003                         && (evp->_major==CORBA_SYSTEM_EXCEPTION && !strcmp(ex_CORBA_COMM_FAILURE,CORBA_exception_id(evp)))) {
1004                 r=GNOME_VFS_ERROR_SERVICE_NOT_AVAILABLE;
1005                 if (captive_vfs_parent_object->corba_Vfs_object!=CORBA_OBJECT_NIL)
1006                         captive_vfs_parent_object_aborted(captive_vfs_parent_object);   /* errors ignored */
1007                 }
1008         else if (evp->_major==CORBA_USER_EXCEPTION && !strcmp(ex_Captive_GnomeVFSResultException,CORBA_exception_id(evp))) {
1009                 r=((Captive_GnomeVFSResultException *)CORBA_exception_value(evp))->gnome_vfs_result;
1010                 g_assert(r!=GNOME_VFS_ERROR_SERVICE_NOT_AVAILABLE);     /* code reserved for sandbox restarts */
1011                 }
1012         else {
1013                 r=GNOME_VFS_ERROR_GENERIC;
1014                 g_warning(_("CORBA Exception occured: id=\"%s\", value=%p"),
1015                                 CORBA_exception_id(evp),CORBA_exception_value(evp));
1016                 }
1017         CORBA_exception_free(evp);
1018
1019         return r;
1020 }
1021
1022
1023 void captive_sandbox_child_GnomeVFSResultException_throw(CORBA_Environment *evp,GnomeVFSResult errvfsresult)
1024 {
1025 Captive_GnomeVFSResultException *gnome_vfs_result_exception;
1026
1027         g_return_if_fail(evp!=NULL);
1028
1029         gnome_vfs_result_exception=Captive_GnomeVFSResultException__alloc();
1030         gnome_vfs_result_exception->gnome_vfs_result=errvfsresult;
1031         CORBA_exception_set(evp,CORBA_USER_EXCEPTION,ex_Captive_GnomeVFSResultException,gnome_vfs_result_exception);
1032 }