src/libcaptive/sandbox/split.c

   1 /* $Id$
   2  * Connection of captive-vfs interface through CORBA/ORBit
   3  * Copyright (C) 2002 Jan Kratochvil <project-captive@jankratochvil.net>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; exactly version 2 of June 1991 is required
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  17  */
  18
  19
  20 #include "config.h"
  21
  22 #include "split.h"      /* self */
  23 #include "sandbox.h"
  24 #include "server-GLogFunc.h"
  25 #include "captive/macros.h"
  26 #include <glib/gmacros.h>
  27 #include <stdlib.h>
  28 #include "captive/rtl-file.h"
  29 #include <unistd.h>
  30 #include <fcntl.h>
  31 #include <linc/linc.h>  /* for linc_main_get_loop() */
  32 #include "server-Directory.h"
  33 #include "server-Vfs.h"
  34 #include "../client/vfs.h"
  35 #include "captive/parent-Vfs.h"
  36 #include <dirent.h>
  37 #include "server-CaptiveIOChannel.h"
  38 #include <errno.h>
  39 #include "../client/giochannel-blind.h" /* for captive_giochannel_blind_new() */
  40
  41
  42 /* CONFIG: */
  43
  44 #define HEARTBEAT_SOURCE_CHECK_EVENTS (G_IO_IN|G_IO_PRI)
  45 #define HEARTBEAT_SOURCE_CHECK_REVENTS (HEARTBEAT_SOURCE_CHECK_EVENTS|G_IO_ERR|G_IO_HUP|G_IO_NVAL)
  46
  47
  48 gboolean validate_CORBA_Environment(CORBA_Environment *evp)
  49 {
  50         if (evp->_major==CORBA_NO_EXCEPTION)
  51                 return TRUE;
  52
  53         g_message(_("CORBA Exception occured: id=\"%s\", value=%p"),
  54                         CORBA_exception_id(evp),CORBA_exception_value(evp));
  55         return FALSE;
  56 }
  57
  58 CORBA_Environment captive_corba_ev;
  59 CORBA_ORB captive_corba_orb;
  60 PortableServer_POA captive_corba_poa;
  61
  62 static void corba_shutdown_atexit(void);
  63
  64 static gboolean corba_init(const char *pname,CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
  65 {
  66 static gboolean done=FALSE;
  67 int orb_argc=1;
  68 gchar *orb_argv[]={
  69                 (gchar *)captive_strdup_alloca(pname),
  70                 NULL};
  71
  72         g_return_val_if_fail(evp!=NULL,FALSE);
  73         g_return_val_if_fail(orbp!=NULL,FALSE);
  74         g_return_val_if_fail(poap!=NULL,FALSE);
  75
  76         if (done)
  77                 return TRUE;
  78
  79         /* Init 'ev' */
  80         CORBA_exception_init(evp);
  81
  82         /* Init 'orb' */
  83         *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-orb",evp);
  84         g_return_val_if_fail(*orbp!=CORBA_OBJECT_NIL,FALSE);
  85         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  86
  87         /* Init 'poa' */
  88         *poap=(PortableServer_POA)CORBA_ORB_resolve_initial_references(*orbp,"RootPOA",evp);
  89         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  90         {
  91 PortableServer_POAManager poa_mgr;
  92                 poa_mgr=PortableServer_POA__get_the_POAManager(*poap,evp);
  93                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  94                 PortableServer_POAManager_activate(poa_mgr,evp);
  95                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  96                 CORBA_Object_release((CORBA_Object)poa_mgr,evp);
  97                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  98                 }
  99
 100         g_atexit(corba_shutdown_atexit);
 101
 102         done=TRUE;
 103         return TRUE;
 104 }
 105
 106
 107 static CORBA_ORB heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 108
 109 gboolean corba_shutdown(CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
 110 {
 111 PortableServer_POA poa;
 112 CORBA_ORB orb;
 113
 114         g_return_val_if_fail(evp!=NULL,FALSE);
 115         g_return_val_if_fail(orbp!=NULL,FALSE);
 116         g_return_val_if_fail(poap!=NULL,FALSE);
 117
 118         /* Shutdown 'poa' */
 119         poa=*poap;
 120         *poap=CORBA_OBJECT_NIL;
 121         CORBA_Object_release((CORBA_Object)poa,evp);
 122         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 123
 124         /* Shutdown 'orb' */
 125         orb=*orbp;
 126         *orbp=CORBA_OBJECT_NIL;
 127         heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 128         CORBA_ORB_destroy(orb,evp);
 129         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 130
 131         /* Shutdown 'ev' */
 132         CORBA_exception_free(evp);
 133
 134         return TRUE;
 135 }
 136
 137 static void corba_shutdown_atexit(void)
 138 {
 139 gboolean errbool;
 140
 141         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 142         g_assert(errbool==TRUE);
 143 }
 144
 145
 146 static GSource *captive_corba_sandbox_child_heartbeat_gsource;
 147
 148 void sandbox_child_prepare_shutdown(void)
 149 {
 150         /* Prevent during shutdown: Captive-WARNING **: CORBA Exception occured: id="IDL:omg.org/CORBA/COMM_FAILURE:1.0" */
 151         if (captive_corba_sandbox_child_heartbeat_gsource) {
 152                 g_source_destroy(captive_corba_sandbox_child_heartbeat_gsource);
 153                 g_source_unref(captive_corba_sandbox_child_heartbeat_gsource);
 154                 captive_corba_sandbox_child_heartbeat_gsource=NULL;
 155                 }
 156 }
 157
 158
 159 void sandbox_child_shutdown(void)
 160 {
 161         /* Do not fail by passing logging messages to the master. */
 162         impl_Captive_Vfs_init_g_log_func_disable();
 163
 164         g_main_loop_quit(linc_main_get_loop());
 165 }
 166
 167
 168 static gboolean heartbeat_source_callback(gpointer data /* unused */)
 169 {
 170         g_return_val_if_fail(heartbeat_source_callback_orb!=CORBA_OBJECT_NIL,FALSE);    /* the source should be removed */
 171
 172         sandbox_child_shutdown();
 173
 174         return FALSE;   /* the source should be removed */
 175 }
 176
 177
 178 static gboolean heartbeat_source_prepare(GSource *source,gint *timeout)
 179 {
 180         *timeout=-1;
 181
 182         return FALSE;
 183 }
 184
 185 static GPollFD heartbeat_source_check_gpollfd;
 186
 187 static gboolean heartbeat_source_check(GSource *source)
 188 {
 189         return !!(heartbeat_source_check_gpollfd.revents & HEARTBEAT_SOURCE_CHECK_REVENTS);
 190 }
 191
 192 static gboolean heartbeat_source_dispatch(GSource *source,GSourceFunc callback,gpointer user_data)
 193 {
 194         g_assert(callback!=NULL);
 195         return (*callback)(user_data);
 196 }
 197
 198 static GSourceFuncs heartbeat_source_watch_funcs={
 199                 heartbeat_source_prepare,
 200                 heartbeat_source_check,
 201                 heartbeat_source_dispatch,
 202                 NULL,   /* finalize */
 203                 };
 204
 205 void captive_corba_sandbox_child(const gchar *chrooted_orbit_dir)
 206 {
 207 Captive_Vfs Vfs_object;
 208 impl_POA_Captive_Vfs *Vfs_servant;
 209 gboolean errbool;
 210 guint errguint;
 211 GSource *gsource;
 212 int errint;
 213
 214         /* attach heartbeat_source_callback() to watch for any abnormalities
 215          * on our open pipe 'parentheart_fds' and terminate the child if parent dies.
 216          */
 217         gsource=g_source_new(&heartbeat_source_watch_funcs,sizeof(GSource));
 218         g_return_if_fail(gsource!=NULL);
 219         g_source_set_callback(
 220                         gsource,        /* source */
 221                         heartbeat_source_callback,      /* func */
 222                         NULL,   /* data */
 223                         NULL);  /* notify */
 224         heartbeat_source_check_gpollfd.fd=0 /* STDIN */;        /* parentheart_fd_read */
 225         heartbeat_source_check_gpollfd.events=HEARTBEAT_SOURCE_CHECK_EVENTS;
 226         heartbeat_source_check_gpollfd.revents=0;
 227         g_source_add_poll(gsource,&heartbeat_source_check_gpollfd);
 228
 229         errbool=corba_init("captive-sandbox-child",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 230         g_return_if_fail(errbool==TRUE);
 231
 232         heartbeat_source_callback_orb=captive_corba_orb;
 233
 234         /* linc_main_get_loop() makes sense only after corba_init() -> CORBA_ORB_init() */
 235         errguint=g_source_attach(
 236                         gsource,        /* source */
 237                         g_main_loop_get_context(linc_main_get_loop())); /* context; NULL means 'default context' */
 238         g_assert(errguint!=0);
 239
 240         /* Init 'Vfs_object' */
 241         Vfs_object=impl_Captive_Vfs__create(captive_corba_poa,&captive_corba_ev);
 242         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 243
 244         /* Pass IOR to our parent.
 245          * It will also create the socket needed for 'chrooted_orbit_dir' below
 246          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 247          */
 248         {
 249 char *Vfs_IOR;
 250                 Vfs_IOR=CORBA_ORB_object_to_string(captive_corba_orb,Vfs_object,&captive_corba_ev);
 251                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 252                 g_assert(Vfs_IOR!=NULL);
 253                 errint=printf("ior=%s\n",Vfs_IOR);
 254                 g_assert(errint>=0);
 255                 CORBA_free(Vfs_IOR);
 256                 }
 257
 258         /* Default mode is 0700, permit parent non-"captive" users to access our IOR socket. */
 259         if (chrooted_orbit_dir) {
 260 DIR *dir;
 261 struct dirent *dirent;
 262 const gchar *socketname=NULL,*socketpathname;
 263
 264                 errint=chmod(chrooted_orbit_dir,0755);
 265                 g_assert(errint==0);
 266
 267                 dir=opendir(chrooted_orbit_dir);
 268                 g_assert(dir!=NULL);
 269                 while (errno=0,(dirent=readdir(dir))) {
 270                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 271                                 continue;
 272                         g_assert(socketname==NULL);
 273                         socketname=captive_strdup_alloca(dirent->d_name);
 274                         }
 275                 g_assert(errno==0);
 276                 errint=closedir(dir);
 277                 g_assert(errint==0);
 278                 g_assert(socketname!=NULL);
 279
 280                 socketpathname=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
 281                 errint=chmod(socketpathname,0666);
 282                 g_assert(errint==0);
 283
 284                 printf("socketname=%s\n",socketname);
 285                 }
 286
 287         /* Close the output to flush it to our spawning parent. */
 288         errint=fflush(stdout);
 289         g_assert(errint==0);
 290         errint=fclose(stdout);
 291         g_assert(errint==0);
 292
 293         /* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
 294          * and therefore we should be safe with glib events handling.
 295          */
 296         CORBA_ORB_run(captive_corba_orb,&captive_corba_ev);
 297         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 298
 299         /* Shutdown 'Vfs' servant */
 300         Vfs_servant=PortableServer_POA_reference_to_servant(captive_corba_poa,Vfs_object,&captive_corba_ev);
 301         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 302         CORBA_Object_release(Vfs_object,&captive_corba_ev);
 303         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 304         impl_Captive_Vfs__destroy(Vfs_servant,&captive_corba_ev);
 305         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 306
 307         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 308         g_assert(errbool==TRUE);
 309
 310         _exit(EXIT_SUCCESS);
 311 }
 312
 313
 314 static void options_module_captive_to_options_module_corba
 315                 (Captive_CaptiveOptionsModule *dest_options_module_corba,const struct captive_options_module *src_options_module_captive)
 316 {
 317         g_return_if_fail(dest_options_module_corba!=NULL);
 318         g_return_if_fail(src_options_module_captive!=NULL);
 319
 320         g_return_if_fail(src_options_module_captive->type==CAPTIVE_OPTIONS_MODULE_TYPE_PE32);
 321
 322         dest_options_module_corba->pathname_utf8=g_strdup(src_options_module_captive->pathname_utf8);
 323         dest_options_module_corba->data._buffer=g_memdup(src_options_module_captive->u.pe32.base,
 324                         src_options_module_captive->u.pe32.length);
 325         dest_options_module_corba->data._maximum=src_options_module_captive->u.pe32.length;
 326         dest_options_module_corba->data._length =src_options_module_captive->u.pe32.length;
 327         dest_options_module_corba->data._release=TRUE;
 328 }
 329
 330
 331 static const gchar *sandbox_parent_own_orbit_dir;
 332 static const gchar *sandbox_parent_own_orbit_socket;
 333
 334 gchar *sandbox_parent_read_ior(int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp)
 335 {
 336 gchar *data;
 337 gsize data_size;
 338 GHashTable *hash;
 339 gchar *ior,*child_chroot_pid_hashkey_dir;
 340 int errint;
 341 gchar *s,*sd,*se;
 342 gboolean errbool;
 343
 344         /* Initialize /tmp/orbit-$username directory for linking IOR socket. */
 345         errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 346         g_assert(errbool==TRUE);
 347
 348         /* FIXME: Security: Duplicate giop_tmpdir_init() here. */
 349         if (!sandbox_parent_own_orbit_dir) {
 350                 sandbox_parent_own_orbit_dir=g_strdup_printf("/tmp/captive-orbit-%d",getpid());
 351                 if (mkdir(sandbox_parent_own_orbit_dir,0700)) {
 352 DIR *dir;
 353 struct dirent *dirent;
 354                         g_assert(errno==EEXIST);
 355
 356                         dir=opendir(sandbox_parent_own_orbit_dir);
 357                         g_assert(dir!=NULL);
 358
 359                         while (errno=0,(dirent=readdir(dir))) {
 360 gchar *pathname;
 361                                 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 362                                         continue;
 363                                 pathname=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
 364                                 errint=unlink(pathname);
 365                                 g_assert(errint==0);
 366                                 g_free(pathname);
 367                                 }
 368                         g_assert(errno==0);
 369                         errint=closedir(dir);
 370                         g_assert(errint==0);
 371                         }
 372                 linc_set_tmpdir(sandbox_parent_own_orbit_dir);
 373                 }
 374
 375         data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
 376         errint=close(Vfs_IOR_fd_read);
 377         g_assert(errint==0);
 378         g_assert(data!=NULL);
 379         g_assert(data_size>=1);
 380         g_assert(data[data_size-1]=='\n');
 381
 382         hash=g_hash_table_new(g_str_hash,g_str_equal);
 383
 384         for (s=data;s<data+data_size;s=se+1) {
 385                 se=strchr(s,'\n');
 386                 g_assert(se!=NULL);
 387                 *se=0;
 388                 sd=strchr(s,'=');
 389                 g_assert(sd!=NULL);
 390                 *sd=0;
 391                 g_hash_table_insert(hash,s,sd+1);
 392                 }
 393         g_assert(s==data+data_size);
 394
 395         if ((child_chroot_pid_hashkey_dir=g_hash_table_lookup(hash,"chroot_pid_hashkey_dir"))) {
 396 const gchar *socketname,*socketpathname_src,*socketpathname_dest;
 397 const gchar *chrooted_orbit_dir;
 398
 399                 /* IOR contains the full pathname with the setuid username encoded. */
 400                 chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
 401                 g_assert(chrooted_orbit_dir!=NULL);
 402                 if (mkdir(chrooted_orbit_dir,S_ISVTX|0777)) {
 403                         g_assert(errno==EEXIST);
 404                         }
 405
 406                 socketname=g_hash_table_lookup(hash,"socketname");
 407                 g_assert(socketname!=NULL);
 408
 409                 socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
 410                 socketpathname_dest=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
 411                 errint=link(socketpathname_src,socketpathname_dest);
 412                 g_assert(errint==0);
 413                 }
 414         if (child_chroot_pid_hashkey_dirp)
 415                 *child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
 416
 417         ior=g_hash_table_lookup(hash,"ior");
 418         g_assert(ior!=NULL);
 419         ior=g_strdup(ior);
 420         g_free(data);
 421
 422         g_hash_table_destroy(hash);
 423
 424         return ior;
 425 }
 426
 427
 428 static void sandbox_parent(const gchar *Vfs_IOR,const gchar *child_chroot_pid_hashkey_dir,
 429                 struct captive_options *options_captive,Captive_Vfs *corba_Vfs_object_return,
 430                 Captive_GLogFunc *corba_GLogFunc_object_return,Captive_CaptiveIOChannel *corba_CaptiveIOChannel_object_return,
 431                 GIOChannel **corba_parent_giochanel_blind_ptr)
 432 {
 433 Captive_Vfs Vfs_object;
 434 Captive_GLogFunc GLogFunc_object;
 435 Captive_CaptiveIOChannel CaptiveIOChannel_object;
 436 Captive_CaptiveOptions options_corba;
 437 guint load_module_length,load_moduleui;
 438 struct captive_options_module *options_module;
 439 GList *load_module_node;
 440 const gchar *child_chroot_parent_own_orbit_socket,*child_chroot_parent_own_orbit_dir;
 441 int errint;
 442
 443         g_return_if_fail(Vfs_IOR!=NULL);
 444         g_return_if_fail(corba_Vfs_object_return!=NULL);
 445         g_return_if_fail(corba_GLogFunc_object_return!=NULL);
 446         g_return_if_fail(corba_CaptiveIOChannel_object_return!=NULL);
 447
 448         Vfs_object=CORBA_ORB_string_to_object(captive_corba_orb,Vfs_IOR,&captive_corba_ev);
 449         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 450
 451         /* Init 'GLogFunc_object' */
 452         GLogFunc_object=impl_Captive_GLogFunc__create(captive_corba_poa,&captive_corba_ev);
 453         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 454
 455         /* Init 'CaptiveIOChannel_object' */
 456         if (!*corba_parent_giochanel_blind_ptr)
 457                 *corba_parent_giochanel_blind_ptr=(GIOChannel *)captive_giochannel_blind_new(options_captive->image_iochannel);
 458         CaptiveIOChannel_object=impl_Captive_CaptiveIOChannel__create(captive_corba_poa,
 459                         *corba_parent_giochanel_blind_ptr,&captive_corba_ev);
 460         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 461
 462         /* Create the socket needed for 'sandbox_parent_own_orbit_socket' below
 463          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 464          */
 465         {
 466 char *GLogFunc_IOR;
 467                 GLogFunc_IOR=CORBA_ORB_object_to_string(captive_corba_orb,GLogFunc_object,&captive_corba_ev);
 468                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 469                 g_assert(GLogFunc_IOR!=NULL);
 470                 CORBA_free(GLogFunc_IOR);
 471                 }
 472
 473         if (sandbox_parent_own_orbit_dir && !sandbox_parent_own_orbit_socket) {
 474 DIR *dir;
 475 struct dirent *dirent;
 476
 477                 dir=opendir(sandbox_parent_own_orbit_dir);
 478                 g_assert(dir!=NULL);
 479
 480                 while (errno=0,(dirent=readdir(dir))) {
 481                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 482                                 continue;
 483                         g_assert(sandbox_parent_own_orbit_socket==NULL);
 484                         sandbox_parent_own_orbit_socket=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
 485                         }
 486                 g_assert(errno==0);
 487                 errint=closedir(dir);
 488                 g_assert(errint==0);
 489                 g_assert(sandbox_parent_own_orbit_socket!=NULL);
 490                 }
 491
 492         if (child_chroot_pid_hashkey_dir) {
 493                 child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
 494                 errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
 495                 g_assert(errint==0);
 496                 child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
 497                                 child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
 498                 errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
 499                 g_assert(errint==0);
 500                 /* chmod(2)s also our orig. one (!) but this one is protected by its 0777 directory. */
 501                 errint=chmod(child_chroot_parent_own_orbit_socket,0666);
 502                 g_assert(errint==0);
 503                 }
 504
 505         options_corba.g_log_func=GLogFunc_object;
 506         options_module_captive_to_options_module_corba(&options_corba.filesystem,&options_captive->filesystem);
 507         /* Prevent secondary captive_giochannel_blind inside of our sandbox child
 508          * as we already have one captive_giochannel_blind in the parent.
 509          */
 510         options_corba.rwmode        =(options_captive->rwmode == CAPTIVE_OPTION_RWMODE_BLIND ? CAPTIVE_OPTION_RWMODE_RW
 511                         : options_captive->rwmode);
 512         options_corba.media         =options_captive->media;
 513         options_corba.debug_messages=options_captive->debug_messages;
 514         options_corba.image_iochannel=CaptiveIOChannel_object;
 515
 516         load_module_length=g_list_length(options_captive->load_module);
 517         captive_newn(options_corba.load_module._buffer,load_module_length);
 518         options_corba.load_module._maximum=load_module_length;
 519         options_corba.load_module._length=load_module_length;
 520         options_corba.load_module._release=TRUE;
 521         for (load_moduleui=0,load_module_node=options_captive->load_module;
 522                         load_module_node;
 523                         load_moduleui++,load_module_node=load_module_node->next) {
 524                 options_module=load_module_node->data;
 525                 options_module_captive_to_options_module_corba(options_corba.load_module._buffer+load_moduleui,options_module);
 526                 }
 527
 528         Captive_Vfs_init(Vfs_object,&options_corba,&captive_corba_ev);
 529         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 530
 531         /* FIXME: Free 'options_corba' - LEAK */
 532
 533         *corba_Vfs_object_return=Vfs_object;
 534         *corba_GLogFunc_object_return=GLogFunc_object;
 535         *corba_CaptiveIOChannel_object_return=CaptiveIOChannel_object;
 536 }
 537
 538 static void fd_shiftup(int *fdp)
 539 {
 540         g_return_if_fail(fdp!=NULL);
 541
 542         while (*fdp<=2 /* STDERR */) {
 543                 *fdp=dup(*fdp);
 544                 g_assert(*fdp!=-1);
 545                 }
 546 }
 547
 548 void captive_sandbox_fd_closeup(int fd_first_to_delete)
 549 {
 550 DIR *dir;
 551 int errint;
 552 int dir_fd;
 553 struct dirent *dirent;
 554
 555         dir=opendir("/proc/self/fd/");
 556         g_return_if_fail(dir!=NULL);
 557         dir_fd=dirfd(dir);
 558         g_return_if_fail(dir_fd!=-1);
 559
 560         while (errno=0,(dirent=readdir(dir))) {
 561 long dirent_fd;
 562 char *endptr;
 563
 564                 if (0
 565                                 || !strcmp(dirent->d_name,".")
 566                                 || !strcmp(dirent->d_name,".."))
 567                         continue;
 568                 dirent_fd=strtol(dirent->d_name,&endptr,10 /* base */);
 569                 g_assert(dirent_fd>=0 && (!endptr || !*endptr));
 570                 if (dirent_fd<fd_first_to_delete || dirent_fd==dir_fd)
 571                         continue;
 572
 573                 errint=close(dirent_fd);
 574                 g_assert(errint==0);
 575                 errno=0;
 576                 errint=close(dirent_fd);
 577                 g_assert(errint==-1); g_assert(errno==EBADF);
 578                 }
 579         g_return_if_fail(errno==0);     /* check for EOF */
 580
 581         errint=closedir(dir);
 582         g_return_if_fail(errint==0);
 583         errno=0;
 584         close(dir_fd); g_assert(errno==EBADF);  /* just a bit of paranoia; it should be already closed by closedir() */
 585 }
 586
 587 gboolean captive_sandbox_spawn(CaptiveVfsObject *child_captive_vfs_object,
 588                 Captive_Vfs *corba_Vfs_object_return,Captive_GLogFunc *corba_GLogFunc_object_return,
 589                 Captive_CaptiveIOChannel *corba_CaptiveIOChannel_object_return,GIOChannel **corba_parent_giochanel_blind_ptr,
 590                 int *parentheart_fds_1_return,pid_t *child_pid_return)
 591 {
 592 /* Vfs_IOR_fds[0] for reading by sandbox_parent() - client,
 593  * Vfs_IOR_fds[1] for writing by sandbox_child()  - server
 594  */
 595 int Vfs_IOR_fds[2],parentheart_fds[2];
 596 int errint;
 597 gboolean errbool;
 598
 599         g_return_val_if_fail(child_captive_vfs_object!=NULL,FALSE);
 600         g_return_val_if_fail(corba_Vfs_object_return!=NULL,FALSE);
 601         g_return_val_if_fail(corba_GLogFunc_object_return!=NULL,FALSE);
 602         g_return_val_if_fail(parentheart_fds_1_return!=NULL,FALSE);
 603         g_return_val_if_fail(child_pid_return!=NULL,FALSE);
 604
 605         errint=pipe(Vfs_IOR_fds);
 606         g_return_val_if_fail(errint==0,FALSE);
 607         errint=pipe(parentheart_fds);
 608         g_return_val_if_fail(errint==0,FALSE);
 609
 610         /* Currently never called anywhere:
 611          *     errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 612          *     g_assert(errbool==TRUE);
 613          */
 614
 615         if (child_captive_vfs_object->options.sandbox_server_ior) {
 616                 g_assert(child_captive_vfs_object->options.sandbox_server_argv==NULL);
 617
 618                 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 619                 g_assert(errbool==TRUE);
 620
 621                 *parentheart_fds_1_return=-1;
 622                 *child_pid_return=-1;
 623                 sandbox_parent(
 624                                 child_captive_vfs_object->options.sandbox_server_ior,   /* Vfs_IOR */
 625                                 NULL,   /* child_chroot_pid_hashkey_dir */
 626                                 &child_captive_vfs_object->options,     /* options_captive */
 627                                 corba_Vfs_object_return,        /* corba_Vfs_object_return */
 628                                 corba_GLogFunc_object_return,   /* corba_GLogFunc_object_return */
 629                                 corba_CaptiveIOChannel_object_return,   /* corba_CaptiveIOChannel_object_return */
 630                                 corba_parent_giochanel_blind_ptr);      /* corba_parent_giochanel_blind_ptr */
 631                 return TRUE;
 632                 }
 633
 634         g_assert(child_captive_vfs_object->options.sandbox_server_argv!=NULL);
 635         switch ((*child_pid_return=fork())) {
 636                 case -1:        /* error */
 637                         g_return_val_if_reached(FALSE);
 638
 639                 case 0: { /* child */
 640
 641                         errint=close(Vfs_IOR_fds[0]);   /* close Vfs_IOR_fd_read */
 642                         g_return_val_if_fail(errint==0,FALSE);
 643                         errint=close(parentheart_fds[1]);       /* close parentheart_fd_write */
 644                         g_return_val_if_fail(errint==0,FALSE);
 645
 646                         fd_shiftup(Vfs_IOR_fds+1);      /* Vfs_IOR_fd_write */
 647                         fd_shiftup(parentheart_fds+0);  /* parentheart_fd_read */
 648                         errint=dup2(Vfs_IOR_fds[1],1 /* STDOUT */);     /* Vfs_IOR_fd_write */
 649                         g_return_val_if_fail(errint==1 /* STDOUT */,FALSE);
 650                         errint=dup2(parentheart_fds[0],0 /* STDIN */);  /* parentheart_fd_read */
 651                         g_return_val_if_fail(errint==0 /* STDIN */,FALSE);
 652
 653                         captive_sandbox_fd_closeup(2 /* STDERR */ +1);
 654
 655                         execv(child_captive_vfs_object->options.sandbox_server_argv[0],
 656                                         /* re-const */ (char * const *)child_captive_vfs_object->options.sandbox_server_argv);
 657                         g_return_val_if_reached(FALSE);
 658                         } /* NOTREACHED */
 659
 660                 default: {      /* parent */
 661 gchar *Vfs_IOR;
 662 gchar *child_chroot_pid_hashkey_dir;
 663
 664                         errint=close(Vfs_IOR_fds[1]);   /* close Vfs_IOR_fd_write */
 665                         g_return_val_if_fail(errint==0,FALSE);
 666                         errint=close(parentheart_fds[0]);       /* close parentheart_fd_read */
 667                         g_return_val_if_fail(errint==0,FALSE);
 668                         errint=fcntl(parentheart_fds[1],F_SETFD,FD_CLOEXEC);
 669                         /* This fcntl(2) may not be enough - some fork(2) may duplicate this
 670                          * write descriptor and even if we do some process finish the child
 671                          * may remain alone connected with some unknown fork(2)er from us.
 672                          * Currently I am not aware such case would occur.
 673                          */
 674                         g_return_val_if_fail(errint==0,FALSE);
 675                         *parentheart_fds_1_return=parentheart_fds[1];
 676
 677                         Vfs_IOR=sandbox_parent_read_ior(
 678                                         Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
 679                                         &child_chroot_pid_hashkey_dir);
 680
 681                         sandbox_parent(
 682                                         Vfs_IOR,        /* Vfs_IOR */
 683                                         child_chroot_pid_hashkey_dir,   /* child_chroot_pid_hashkey_dir */
 684                                         &child_captive_vfs_object->options,     /* options_captive */
 685                                         corba_Vfs_object_return,        /* corba_Vfs_object_return */
 686                                         corba_GLogFunc_object_return,   /* corba_GLogFunc_object_return */
 687                                         corba_CaptiveIOChannel_object_return,   /* corba_CaptiveIOChannel_object_return */
 688                                         corba_parent_giochanel_blind_ptr);      /* corba_parent_giochanel_blind_ptr */
 689
 690                         g_free(Vfs_IOR);
 691                         g_free(child_chroot_pid_hashkey_dir);
 692
 693                         /* 'parentheart_fds[1]' - parentheart_fd_write - is left open here */
 694                         return TRUE;
 695                         }
 696                 }
 697         /* NOTREACHED */
 698         g_return_val_if_reached(FALSE);
 699 }
 700
 701
 702 GnomeVFSResult captive_sandbox_parent_return_from_CORBA_Environment(CORBA_Environment *evp)
 703 {
 704 GnomeVFSResult r;
 705
 706         if (evp->_major==CORBA_NO_EXCEPTION)
 707                 return GNOME_VFS_OK;
 708
 709         if (evp->_major==CORBA_USER_EXCEPTION && !strcmp(ex_Captive_GnomeVFSResultException,CORBA_exception_id(evp)))
 710                 r=((Captive_GnomeVFSResultException *)CORBA_exception_value(evp))->gnome_vfs_result;
 711         else {
 712                 r=GNOME_VFS_ERROR_GENERIC;
 713                 g_warning(_("CORBA Exception occured: id=\"%s\", value=%p"),
 714                                 CORBA_exception_id(evp),CORBA_exception_value(evp));
 715                 }
 716         CORBA_exception_free(evp);
 717
 718         return r;
 719 }
 720
 721
 722 gboolean captive_sandbox_parent_query_vfs_retry(CORBA_Environment *evp,CaptiveVfsObject *captive_vfs_object)
 723 {
 724 GnomeVFSResult errvfsresult;
 725
 726         g_return_val_if_fail(evp!=NULL,FALSE);
 727         g_return_val_if_fail(captive_vfs_object!=NULL,FALSE);
 728
 729         /* If !child_captive_vfs_object->options.sandbox_server_argv it is child_captive_vfs_object->options.sandbox_server_ior
 730          * where we cannot do any restart anyway.
 731          */
 732         if (!captive_vfs_object->options.sandbox_server_argv
 733                         || !(evp->_major==CORBA_SYSTEM_EXCEPTION && !strcmp(ex_CORBA_COMM_FAILURE,CORBA_exception_id(evp))))
 734                 return FALSE;   /* no retry */
 735         CORBA_exception_free(evp);
 736
 737         captive_sandbox_parent_vfs_close(captive_vfs_object);   /* errors ignored */
 738         errvfsresult=captive_sandbox_parent_vfs_new(captive_vfs_object);
 739
 740         return errvfsresult==GNOME_VFS_OK;      /* retry if restart succeeded */
 741 }
 742
 743
 744 void captive_sandbox_child_GnomeVFSResultException_throw(CORBA_Environment *evp,GnomeVFSResult errvfsresult)
 745 {
 746 Captive_GnomeVFSResultException *gnome_vfs_result_exception;
 747
 748         g_return_if_fail(evp!=NULL);
 749
 750         gnome_vfs_result_exception=Captive_GnomeVFSResultException__alloc();
 751         gnome_vfs_result_exception->gnome_vfs_result=errvfsresult;
 752         CORBA_exception_set(evp,CORBA_USER_EXCEPTION,ex_Captive_GnomeVFSResultException,gnome_vfs_result_exception);
 753 }