2 * Connection of captive-vfs interface through CORBA/ORBit
3 * Copyright (C) 2002 Jan Kratochvil <project-captive@jankratochvil.net>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; exactly version 2 of June 1991 is required
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include "split.h" /* self */
24 #include "server-GLogFunc.h"
25 #include "captive/macros.h"
26 #include <glib/gmacros.h>
28 #include "captive/rtl-file.h"
31 #include <linc/linc.h> /* for linc_main_get_loop() */
32 #include "server-Directory.h"
33 #include "server-Vfs.h"
34 #include "../client/vfs.h"
35 #include "captive/parent-Vfs.h"
37 #include "server-CaptiveIOChannel.h"
39 #include "../client/giochannel-blind.h" /* for captive_giochannel_blind_new() */
44 #define HEARTBEAT_SOURCE_CHECK_EVENTS (G_IO_IN|G_IO_PRI)
45 #define HEARTBEAT_SOURCE_CHECK_REVENTS (HEARTBEAT_SOURCE_CHECK_EVENTS|G_IO_ERR|G_IO_HUP|G_IO_NVAL)
48 gboolean validate_CORBA_Environment(CORBA_Environment *evp)
50 if (evp->_major==CORBA_NO_EXCEPTION)
53 g_error(_("CORBA Exception occured: id=\"%s\", value=%p"),
54 CORBA_exception_id(evp),CORBA_exception_value(evp));
55 CORBA_exception_free(evp);
59 CORBA_Environment captive_corba_ev;
60 CORBA_ORB captive_corba_orb;
61 PortableServer_POA captive_corba_poa;
63 static void corba_shutdown_atexit(void);
65 static gboolean corba_init(const char *pname,CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
67 static gboolean done=FALSE;
70 (gchar *)captive_strdup_alloca(pname),
73 g_return_val_if_fail(evp!=NULL,FALSE);
74 g_return_val_if_fail(orbp!=NULL,FALSE);
75 g_return_val_if_fail(poap!=NULL,FALSE);
81 CORBA_exception_init(evp);
84 *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-orb",evp);
85 g_return_val_if_fail(*orbp!=CORBA_OBJECT_NIL,FALSE);
86 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
89 *poap=(PortableServer_POA)CORBA_ORB_resolve_initial_references(*orbp,"RootPOA",evp);
90 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
92 PortableServer_POAManager poa_mgr;
93 poa_mgr=PortableServer_POA__get_the_POAManager(*poap,evp);
94 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
95 PortableServer_POAManager_activate(poa_mgr,evp);
96 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
97 CORBA_Object_release((CORBA_Object)poa_mgr,evp);
98 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
101 g_atexit(corba_shutdown_atexit);
108 static CORBA_ORB heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
110 gboolean corba_shutdown(CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
112 PortableServer_POA poa;
115 g_return_val_if_fail(evp!=NULL,FALSE);
116 g_return_val_if_fail(orbp!=NULL,FALSE);
117 g_return_val_if_fail(poap!=NULL,FALSE);
121 *poap=CORBA_OBJECT_NIL;
122 CORBA_Object_release((CORBA_Object)poa,evp);
123 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
127 *orbp=CORBA_OBJECT_NIL;
128 heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
129 CORBA_ORB_destroy(orb,evp);
130 /* Do not: g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
131 * here as CORBA_ORB_destroy() sometimes reports:
132 * WARNING **: ORB: a total of X refs to X ORB objects were leaked
134 CORBA_exception_free(evp);
137 CORBA_exception_free(evp);
142 static void corba_shutdown_atexit(void)
146 errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
147 g_assert(errbool==TRUE);
151 static GSource *captive_corba_sandbox_child_heartbeat_gsource;
153 #if 0 /* Currently unused - see server-Vfs.c:impl_Captive_Vfs_shutdown() */
154 void sandbox_child_prepare_shutdown(void)
156 /* Prevent during shutdown: Captive-WARNING **: CORBA Exception occured: id="IDL:omg.org/CORBA/COMM_FAILURE:1.0" */
157 if (captive_corba_sandbox_child_heartbeat_gsource) {
158 g_source_destroy(captive_corba_sandbox_child_heartbeat_gsource);
159 g_source_unref(captive_corba_sandbox_child_heartbeat_gsource);
160 captive_corba_sandbox_child_heartbeat_gsource=NULL;
166 void sandbox_child_shutdown(void)
168 /* Do not fail by passing logging messages to the master. */
169 impl_Captive_Vfs_init_g_log_func_disable();
171 g_main_loop_quit(linc_main_get_loop());
175 static gboolean heartbeat_source_callback(gpointer data /* unused */)
177 g_return_val_if_fail(heartbeat_source_callback_orb!=CORBA_OBJECT_NIL,FALSE); /* the source should be removed */
179 sandbox_child_shutdown();
181 return FALSE; /* the source should be removed */
185 static gboolean heartbeat_source_prepare(GSource *source,gint *timeout)
192 static GPollFD heartbeat_source_check_gpollfd;
194 static gboolean heartbeat_source_check(GSource *source)
196 return !!(heartbeat_source_check_gpollfd.revents & HEARTBEAT_SOURCE_CHECK_REVENTS);
199 static gboolean heartbeat_source_dispatch(GSource *source,GSourceFunc callback,gpointer user_data)
201 g_assert(callback!=NULL);
202 return (*callback)(user_data);
205 static GSourceFuncs heartbeat_source_watch_funcs={
206 heartbeat_source_prepare,
207 heartbeat_source_check,
208 heartbeat_source_dispatch,
212 void captive_corba_sandbox_child(const gchar *chrooted_orbit_dir)
214 Captive_Vfs Vfs_object;
215 impl_POA_Captive_Vfs *Vfs_servant;
220 /* attach heartbeat_source_callback() to watch for any abnormalities
221 * on our open pipe 'parentheart_fds' and terminate the child if parent dies.
223 captive_corba_sandbox_child_heartbeat_gsource=g_source_new(&heartbeat_source_watch_funcs,sizeof(GSource));
224 g_return_if_fail(captive_corba_sandbox_child_heartbeat_gsource!=NULL);
225 g_source_set_callback(
226 captive_corba_sandbox_child_heartbeat_gsource, /* source */
227 heartbeat_source_callback, /* func */
230 heartbeat_source_check_gpollfd.fd=0 /* STDIN */; /* parentheart_fd_read */
231 heartbeat_source_check_gpollfd.events=HEARTBEAT_SOURCE_CHECK_EVENTS;
232 heartbeat_source_check_gpollfd.revents=0;
233 g_source_add_poll(captive_corba_sandbox_child_heartbeat_gsource,&heartbeat_source_check_gpollfd);
235 errbool=corba_init("captive-sandbox-child",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
236 g_return_if_fail(errbool==TRUE);
238 heartbeat_source_callback_orb=captive_corba_orb;
240 /* linc_main_get_loop() makes sense only after corba_init() -> CORBA_ORB_init() */
241 errguint=g_source_attach(
242 captive_corba_sandbox_child_heartbeat_gsource, /* source */
243 g_main_loop_get_context(linc_main_get_loop())); /* context; NULL means 'default context' */
244 g_assert(errguint!=0);
246 /* Init 'Vfs_object' */
247 Vfs_object=impl_Captive_Vfs__create(captive_corba_poa,&captive_corba_ev);
248 g_assert(validate_CORBA_Environment(&captive_corba_ev));
250 /* Pass IOR to our parent.
251 * It will also create the socket needed for 'chrooted_orbit_dir' below
252 * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
256 Vfs_IOR=CORBA_ORB_object_to_string(captive_corba_orb,Vfs_object,&captive_corba_ev);
257 g_assert(validate_CORBA_Environment(&captive_corba_ev));
258 g_assert(Vfs_IOR!=NULL);
259 errint=printf("ior=%s\n",Vfs_IOR);
264 /* Default mode is 0700, permit parent non-"captive" users to access our IOR socket. */
265 if (chrooted_orbit_dir) {
267 struct dirent *dirent;
268 const gchar *socketname=NULL,*socketpathname;
270 errint=chmod(chrooted_orbit_dir,0755);
273 dir=opendir(chrooted_orbit_dir);
275 while (errno=0,(dirent=readdir(dir))) {
276 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
278 g_assert(socketname==NULL);
279 socketname=captive_strdup_alloca(dirent->d_name);
282 errint=closedir(dir);
284 g_assert(socketname!=NULL);
286 socketpathname=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
287 errint=chmod(socketpathname,0666);
290 printf("socketname=%s\n",socketname);
293 /* Close the output to flush it to our spawning parent. */
294 errint=fflush(stdout);
296 errint=fclose(stdout);
299 /* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
300 * and therefore we should be safe with glib events handling.
302 CORBA_ORB_run(captive_corba_orb,&captive_corba_ev);
303 g_assert(validate_CORBA_Environment(&captive_corba_ev));
305 /* Shutdown 'Vfs' servant */
306 Vfs_servant=PortableServer_POA_reference_to_servant(captive_corba_poa,Vfs_object,&captive_corba_ev);
307 g_assert(validate_CORBA_Environment(&captive_corba_ev));
308 CORBA_Object_release(Vfs_object,&captive_corba_ev);
309 g_assert(validate_CORBA_Environment(&captive_corba_ev));
310 impl_Captive_Vfs__destroy(Vfs_servant,&captive_corba_ev);
311 g_assert(validate_CORBA_Environment(&captive_corba_ev));
313 errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
314 g_assert(errbool==TRUE);
320 static void options_module_captive_to_options_module_corba
321 (Captive_CaptiveOptionsModule *dest_options_module_corba,const struct captive_options_module *src_options_module_captive)
323 g_return_if_fail(dest_options_module_corba!=NULL);
324 g_return_if_fail(src_options_module_captive!=NULL);
326 g_return_if_fail(src_options_module_captive->type==CAPTIVE_OPTIONS_MODULE_TYPE_PE32);
328 dest_options_module_corba->pathname_utf8=g_strdup(src_options_module_captive->pathname_utf8);
329 dest_options_module_corba->data._buffer=g_memdup(src_options_module_captive->u.pe32.base,
330 src_options_module_captive->u.pe32.length);
331 dest_options_module_corba->data._maximum=src_options_module_captive->u.pe32.length;
332 dest_options_module_corba->data._length =src_options_module_captive->u.pe32.length;
333 dest_options_module_corba->data._release=TRUE;
337 static const gchar *sandbox_parent_own_orbit_dir;
338 static const gchar *sandbox_parent_own_orbit_socket;
340 gchar *sandbox_parent_read_ior(int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp)
345 gchar *ior,*child_chroot_pid_hashkey_dir;
350 /* Initialize /tmp/orbit-$username directory for linking IOR socket. */
351 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
352 g_assert(errbool==TRUE);
354 /* FIXME: Security: Duplicate giop_tmpdir_init() here. */
355 if (!sandbox_parent_own_orbit_dir) {
356 sandbox_parent_own_orbit_dir=g_strdup_printf("/tmp/captive-orbit-%d",getpid());
357 if (mkdir(sandbox_parent_own_orbit_dir,0700)) {
359 struct dirent *dirent;
360 g_assert(errno==EEXIST);
362 dir=opendir(sandbox_parent_own_orbit_dir);
365 while (errno=0,(dirent=readdir(dir))) {
367 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
369 pathname=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
370 errint=unlink(pathname);
375 errint=closedir(dir);
378 linc_set_tmpdir(sandbox_parent_own_orbit_dir);
381 data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
382 errint=close(Vfs_IOR_fd_read);
384 g_assert(data!=NULL);
385 g_assert(data_size>=1);
386 g_assert(data[data_size-1]=='\n');
388 hash=g_hash_table_new(g_str_hash,g_str_equal);
390 for (s=data;s<data+data_size;s=se+1) {
397 g_hash_table_insert(hash,s,sd+1);
399 g_assert(s==data+data_size);
401 if ((child_chroot_pid_hashkey_dir=g_hash_table_lookup(hash,"chroot_pid_hashkey_dir"))) {
402 const gchar *socketname,*socketpathname_src,*socketpathname_dest;
403 const gchar *chrooted_orbit_dir;
405 /* IOR contains the full pathname with the setuid username encoded. */
406 chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
407 g_assert(chrooted_orbit_dir!=NULL);
408 if (mkdir(chrooted_orbit_dir,S_ISVTX|0777)) {
409 g_assert(errno==EEXIST);
412 socketname=g_hash_table_lookup(hash,"socketname");
413 g_assert(socketname!=NULL);
415 socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
416 socketpathname_dest=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
417 errint=link(socketpathname_src,socketpathname_dest);
420 if (child_chroot_pid_hashkey_dirp)
421 *child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
423 ior=g_hash_table_lookup(hash,"ior");
428 g_hash_table_destroy(hash);
434 static xmlNode *options_module_captive_to_xml
435 (xmlNode *dest_xml_parent,const struct captive_options_module *src_options_module_captive)
437 g_return_val_if_fail(dest_xml_parent!=NULL,NULL);
438 g_return_val_if_fail(src_options_module_captive!=NULL,NULL);
440 { xmlNode *module=xmlNewTextChild(dest_xml_parent,NULL,"module",NULL);
441 const gchar *type_string,*basename,*cgs;
443 basename=src_options_module_captive->pathname_utf8;
444 if ((cgs=strrchr(basename,'/')))
446 xmlNewProp(module,"basename",basename);
447 switch (src_options_module_captive->type) {
448 case CAPTIVE_OPTIONS_MODULE_TYPE_PE32:
450 xmlNewProp(module,"length",captive_printf_alloca("%lu",(unsigned long)src_options_module_captive->u.pe32.length));
451 xmlNewProp(module,"md5" ,src_options_module_captive->u.pe32.md5);
453 case CAPTIVE_OPTIONS_MODULE_TYPE_GMODULE:
454 type_string="gmodule";
456 default: g_assert_not_reached();
458 xmlNewProp(module,"type",type_string); /* AFTER the 'switch' to set 'type_string'! */
464 static void sandbox_parent_bug_doc_make(CaptiveVfsObject *captive_vfs_object)
466 { xmlDoc *doc=xmlNewDoc("1.0");
467 captive_vfs_object->corba_bug_doc=doc;
468 { xmlNode *bug=xmlNewDocNode(captive_vfs_object->corba_bug_doc,NULL,"bug",NULL);
469 xmlDocSetRootElement(captive_vfs_object->corba_bug_doc,bug);
470 captive_vfs_object->corba_bug=bug;
471 { xmlNode *bug_captive=xmlNewTextChild(bug,NULL,"captive",NULL);
472 xmlNewProp(bug_captive,"version",VERSION);
474 { xmlNode *bug_filesystem=xmlNewTextChild(bug,NULL,"filesystem",NULL);
475 options_module_captive_to_xml(bug_filesystem,&captive_vfs_object->options.filesystem);
477 { xmlNode *bug_load_module=xmlNewTextChild(bug,NULL,"load_module",NULL);
479 struct captive_options_module *options_module;
480 GList *load_module_node;
482 for (load_moduleui=0,load_module_node=captive_vfs_object->options.load_module;
484 load_moduleui++,load_module_node=load_module_node->next) {
485 options_module=load_module_node->data;
486 options_module_captive_to_xml(bug_load_module,options_module);
489 { xmlNode *bug_action=xmlNewTextChild(bug,NULL,"action",NULL);
490 captive_vfs_object->corba_bug_action=bug_action;
492 { xmlNode *bug_log=xmlNewTextChild(bug,NULL,"log",NULL);
493 captive_vfs_object->corba_bug_log=bug_log;
500 static void sandbox_parent(const gchar *Vfs_IOR,const gchar *child_chroot_pid_hashkey_dir,CaptiveVfsObject *captive_vfs_object)
502 Captive_Vfs Vfs_object;
503 Captive_GLogFunc GLogFunc_object;
504 Captive_CaptiveIOChannel CaptiveIOChannel_object;
505 Captive_CaptiveOptions options_corba;
506 guint load_module_length,load_moduleui;
507 struct captive_options_module *options_module;
508 GList *load_module_node;
509 const gchar *child_chroot_parent_own_orbit_socket,*child_chroot_parent_own_orbit_dir;
512 g_return_if_fail(Vfs_IOR!=NULL);
513 /* 'child_chroot_pid_hashkey_dir' may be NULL */
514 g_return_if_fail(captive_vfs_object!=NULL);
516 Vfs_object=CORBA_ORB_string_to_object(captive_corba_orb,Vfs_IOR,&captive_corba_ev);
517 g_assert(validate_CORBA_Environment(&captive_corba_ev));
519 /* Init 'GLogFunc_object' */
520 GLogFunc_object=impl_Captive_GLogFunc__create(captive_corba_poa,captive_vfs_object,&captive_corba_ev);
521 g_assert(validate_CORBA_Environment(&captive_corba_ev));
523 /* Init 'CaptiveIOChannel_object' */
524 if (!captive_vfs_object->corba_parent_giochanel_blind_source)
525 switch (captive_vfs_object->options.rwmode) {
526 case CAPTIVE_OPTION_RWMODE_RO:
527 case CAPTIVE_OPTION_RWMODE_RW:
528 captive_vfs_object->corba_parent_giochanel_blind_source=captive_vfs_object->options.image_iochannel;
530 case CAPTIVE_OPTION_RWMODE_BLIND:
531 captive_vfs_object->corba_parent_giochanel_blind_source=(GIOChannel *)captive_giochannel_blind_new(
532 captive_vfs_object->options.image_iochannel, /* giochannel_orig */
533 TRUE); /* writeable */
535 default: g_assert_not_reached();
537 if (!captive_vfs_object->corba_parent_giochanel_blind)
538 captive_vfs_object->corba_parent_giochanel_blind=(GIOChannel *)captive_giochannel_blind_new(
539 captive_vfs_object->corba_parent_giochanel_blind_source, /* giochannel_orig */
540 (captive_vfs_object->options.rwmode!=CAPTIVE_OPTION_RWMODE_RO)); /* writeable */
541 CaptiveIOChannel_object=impl_Captive_CaptiveIOChannel__create(captive_corba_poa,
542 captive_vfs_object->corba_parent_giochanel_blind,&captive_corba_ev);
543 g_assert(validate_CORBA_Environment(&captive_corba_ev));
545 /* Create the socket needed for 'sandbox_parent_own_orbit_socket' below
546 * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
550 GLogFunc_IOR=CORBA_ORB_object_to_string(captive_corba_orb,GLogFunc_object,&captive_corba_ev);
551 g_assert(validate_CORBA_Environment(&captive_corba_ev));
552 g_assert(GLogFunc_IOR!=NULL);
553 CORBA_free(GLogFunc_IOR);
556 if (sandbox_parent_own_orbit_dir && !sandbox_parent_own_orbit_socket) {
558 struct dirent *dirent;
560 dir=opendir(sandbox_parent_own_orbit_dir);
563 while (errno=0,(dirent=readdir(dir))) {
564 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
566 g_assert(sandbox_parent_own_orbit_socket==NULL);
567 sandbox_parent_own_orbit_socket=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
570 errint=closedir(dir);
572 g_assert(sandbox_parent_own_orbit_socket!=NULL);
575 if (child_chroot_pid_hashkey_dir) {
576 child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
577 errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
579 child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
580 child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
581 errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
583 /* chmod(2)s also our orig. one (!) but this one is protected by its 0777 directory. */
584 errint=chmod(child_chroot_parent_own_orbit_socket,0666);
588 options_corba.g_log_func=GLogFunc_object;
589 options_module_captive_to_options_module_corba(&options_corba.filesystem,&captive_vfs_object->options.filesystem);
590 /* Prevent secondary captive_giochannel_blind inside of our sandbox child
591 * as we already have one captive_giochannel_blind in the parent.
593 options_corba.rwmode =(captive_vfs_object->options.rwmode == CAPTIVE_OPTION_RWMODE_BLIND ? CAPTIVE_OPTION_RWMODE_RW
594 : captive_vfs_object->options.rwmode);
595 options_corba.media =captive_vfs_object->options.media;
596 options_corba.debug_messages=captive_vfs_object->options.debug_messages;
597 options_corba.image_iochannel=CaptiveIOChannel_object;
599 load_module_length=g_list_length(captive_vfs_object->options.load_module);
600 captive_newn(options_corba.load_module._buffer,load_module_length);
601 options_corba.load_module._maximum=load_module_length;
602 options_corba.load_module._length=load_module_length;
603 options_corba.load_module._release=TRUE;
604 for (load_moduleui=0,load_module_node=captive_vfs_object->options.load_module;
606 load_moduleui++,load_module_node=load_module_node->next) {
607 options_module=load_module_node->data;
608 options_module_captive_to_options_module_corba(options_corba.load_module._buffer+load_moduleui,options_module);
611 Captive_Vfs_init(Vfs_object,&options_corba,&captive_corba_ev);
612 g_assert(validate_CORBA_Environment(&captive_corba_ev));
614 /* FIXME: Free 'options_corba' - LEAK */
616 captive_vfs_object->corba_Vfs_object=Vfs_object;
617 captive_vfs_object->corba_GLogFunc_object=GLogFunc_object;
618 captive_vfs_object->corba_CaptiveIOChannel_object=CaptiveIOChannel_object;
620 if (captive_vfs_object->options.bug_pathname)
621 sandbox_parent_bug_doc_make(captive_vfs_object);
624 static void fd_shiftup(int *fdp)
626 g_return_if_fail(fdp!=NULL);
628 while (*fdp<=2 /* STDERR */) {
634 void captive_sandbox_fd_closeup(int fd_first_to_delete)
639 struct dirent *dirent;
641 dir=opendir("/proc/self/fd/");
642 g_return_if_fail(dir!=NULL);
644 g_return_if_fail(dir_fd!=-1);
646 while (errno=0,(dirent=readdir(dir))) {
651 || !strcmp(dirent->d_name,".")
652 || !strcmp(dirent->d_name,".."))
654 dirent_fd=strtol(dirent->d_name,&endptr,10 /* base */);
655 g_assert(dirent_fd>=0 && (!endptr || !*endptr));
656 if (dirent_fd<fd_first_to_delete || dirent_fd==dir_fd)
659 errint=close(dirent_fd);
662 errint=close(dirent_fd);
663 g_assert(errint==-1); g_assert(errno==EBADF);
665 g_return_if_fail(errno==0); /* check for EOF */
667 errint=closedir(dir);
668 g_return_if_fail(errint==0);
670 close(dir_fd); g_assert(errno==EBADF); /* just a bit of paranoia; it should be already closed by closedir() */
673 gboolean captive_sandbox_spawn(CaptiveVfsObject *captive_vfs_object)
675 /* Vfs_IOR_fds[0] for reading by sandbox_parent() - client,
676 * Vfs_IOR_fds[1] for writing by sandbox_child() - server
678 int Vfs_IOR_fds[2],parentheart_fds[2];
682 g_return_val_if_fail(captive_vfs_object!=NULL,FALSE);
684 errint=pipe(Vfs_IOR_fds);
685 g_return_val_if_fail(errint==0,FALSE);
686 errint=pipe(parentheart_fds);
687 g_return_val_if_fail(errint==0,FALSE);
689 /* Currently never called anywhere:
690 * errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
691 * g_assert(errbool==TRUE);
694 if (captive_vfs_object->options.sandbox_server_ior) {
695 g_assert(captive_vfs_object->options.sandbox_server_argv==NULL);
697 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
698 g_assert(errbool==TRUE);
700 captive_vfs_object->corba_parentheart_fds_1=-1;
701 captive_vfs_object->corba_child_pid=-1;
703 captive_vfs_object->options.sandbox_server_ior, /* Vfs_IOR */
704 NULL, /* child_chroot_pid_hashkey_dir */
705 captive_vfs_object); /* captive_vfs_object */
709 g_assert(captive_vfs_object->options.sandbox_server_argv!=NULL);
710 switch ((captive_vfs_object->corba_child_pid=fork())) {
712 g_return_val_if_reached(FALSE);
714 case 0: { /* child */
716 errint=close(Vfs_IOR_fds[0]); /* close Vfs_IOR_fd_read */
717 g_return_val_if_fail(errint==0,FALSE);
718 errint=close(parentheart_fds[1]); /* close parentheart_fd_write */
719 g_return_val_if_fail(errint==0,FALSE);
721 fd_shiftup(Vfs_IOR_fds+1); /* Vfs_IOR_fd_write */
722 fd_shiftup(parentheart_fds+0); /* parentheart_fd_read */
723 errint=dup2(Vfs_IOR_fds[1],1 /* STDOUT */); /* Vfs_IOR_fd_write */
724 g_return_val_if_fail(errint==1 /* STDOUT */,FALSE);
725 errint=dup2(parentheart_fds[0],0 /* STDIN */); /* parentheart_fd_read */
726 g_return_val_if_fail(errint==0 /* STDIN */,FALSE);
728 captive_sandbox_fd_closeup(2 /* STDERR */ +1);
730 execv(captive_vfs_object->options.sandbox_server_argv[0],
731 /* re-const */ (char * const *)captive_vfs_object->options.sandbox_server_argv);
732 g_return_val_if_reached(FALSE);
735 default: { /* parent */
737 gchar *child_chroot_pid_hashkey_dir;
739 errint=close(Vfs_IOR_fds[1]); /* close Vfs_IOR_fd_write */
740 g_return_val_if_fail(errint==0,FALSE);
741 errint=close(parentheart_fds[0]); /* close parentheart_fd_read */
742 g_return_val_if_fail(errint==0,FALSE);
743 errint=fcntl(parentheart_fds[1],F_SETFD,FD_CLOEXEC);
744 /* This fcntl(2) may not be enough - some fork(2) may duplicate this
745 * write descriptor and even if we do some process finish the child
746 * may remain alone connected with some unknown fork(2)er from us.
747 * Currently I am not aware such case would occur.
749 g_return_val_if_fail(errint==0,FALSE);
750 captive_vfs_object->corba_parentheart_fds_1=parentheart_fds[1];
752 Vfs_IOR=sandbox_parent_read_ior(
753 Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
754 &child_chroot_pid_hashkey_dir);
757 Vfs_IOR, /* Vfs_IOR */
758 child_chroot_pid_hashkey_dir, /* child_chroot_pid_hashkey_dir */
759 captive_vfs_object); /* captive_vfs_object */
762 g_free(child_chroot_pid_hashkey_dir);
764 /* 'parentheart_fds[1]' - parentheart_fd_write - is left open here */
769 g_return_val_if_reached(FALSE);
773 GnomeVFSResult captive_sandbox_parent_return_from_CORBA_Environment(CORBA_Environment *evp)
777 if (evp->_major==CORBA_NO_EXCEPTION)
780 if (evp->_major==CORBA_USER_EXCEPTION && !strcmp(ex_Captive_GnomeVFSResultException,CORBA_exception_id(evp)))
781 r=((Captive_GnomeVFSResultException *)CORBA_exception_value(evp))->gnome_vfs_result;
783 r=GNOME_VFS_ERROR_GENERIC;
784 g_warning(_("CORBA Exception occured: id=\"%s\", value=%p"),
785 CORBA_exception_id(evp),CORBA_exception_value(evp));
787 CORBA_exception_free(evp);
793 gboolean captive_sandbox_parent_query_vfs_retry(CORBA_Environment *evp,CaptiveVfsObject *captive_vfs_object)
795 GnomeVFSResult errvfsresult;
798 g_return_val_if_fail(evp!=NULL,FALSE);
799 g_return_val_if_fail(captive_vfs_object!=NULL,FALSE);
801 /* If !captive_vfs_object->options.sandbox_server_argv it is captive_vfs_object->options.sandbox_server_ior
802 * where we cannot do any restart anyway.
804 want_retry=(captive_vfs_object->options.sandbox_server_argv
805 && (evp->_major==CORBA_SYSTEM_EXCEPTION && !strcmp(ex_CORBA_COMM_FAILURE,CORBA_exception_id(evp))));
806 /* Never free 'evp' if returning as no-retry - 'evp' will be reevaluated by the caller! */
808 return FALSE; /* no retry */
809 CORBA_exception_free(evp);
811 captive_sandbox_parent_vfs_close(captive_vfs_object); /* errors ignored */
812 errvfsresult=captive_sandbox_parent_vfs_new(captive_vfs_object);
814 return errvfsresult==GNOME_VFS_OK; /* retry if restart succeeded */
818 void captive_sandbox_child_GnomeVFSResultException_throw(CORBA_Environment *evp,GnomeVFSResult errvfsresult)
820 Captive_GnomeVFSResultException *gnome_vfs_result_exception;
822 g_return_if_fail(evp!=NULL);
824 gnome_vfs_result_exception=Captive_GnomeVFSResultException__alloc();
825 gnome_vfs_result_exception->gnome_vfs_result=errvfsresult;
826 CORBA_exception_set(evp,CORBA_USER_EXCEPTION,ex_Captive_GnomeVFSResultException,gnome_vfs_result_exception);