src/libcaptive/sandbox/split.c

   1 /* $Id$
   2  * Connection of captive-vfs interface through CORBA/ORBit
   3  * Copyright (C) 2002 Jan Kratochvil <project-captive@jankratochvil.net>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; exactly version 2 of June 1991 is required
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  17  */
  18
  19
  20 #include "config.h"
  21
  22 #include "split.h"      /* self */
  23 #include "sandbox.h"
  24 #include "server-GLogFunc.h"
  25 #include "captive/macros.h"
  26 #include <glib/gmacros.h>
  27 #include <stdlib.h>
  28 #include "captive/rtl-file.h"
  29 #include <unistd.h>
  30 #include <fcntl.h>
  31 #include <linc/linc.h>  /* for linc_main_get_loop() */
  32 #include "server-Directory.h"
  33 #include "server-Vfs.h"
  34 #include "../client/vfs.h"
  35 #include "captive/parent-Vfs.h"
  36 #include <dirent.h>
  37 #include "server-CaptiveIOChannel.h"
  38 #include <errno.h>
  39 #include "../client/giochannel-blind.h" /* for captive_giochannel_blind_new() */
  40
  41
  42 /* CONFIG: */
  43
  44 #define HEARTBEAT_SOURCE_CHECK_EVENTS (G_IO_IN|G_IO_PRI)
  45 #define HEARTBEAT_SOURCE_CHECK_REVENTS (HEARTBEAT_SOURCE_CHECK_EVENTS|G_IO_ERR|G_IO_HUP|G_IO_NVAL)
  46
  47
  48 gboolean validate_CORBA_Environment(CORBA_Environment *evp)
  49 {
  50         if (evp->_major==CORBA_NO_EXCEPTION)
  51                 return TRUE;
  52
  53         g_error(_("CORBA Exception occured: id=\"%s\", value=%p"),
  54                         CORBA_exception_id(evp),CORBA_exception_value(evp));
  55         CORBA_exception_free(evp);
  56         return FALSE;
  57 }
  58
  59 CORBA_Environment captive_corba_ev;
  60 CORBA_ORB captive_corba_orb;
  61 PortableServer_POA captive_corba_poa;
  62
  63 static void corba_shutdown_atexit(void);
  64
  65 static gboolean corba_init(const char *pname,CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
  66 {
  67 static gboolean done=FALSE;
  68 int orb_argc=1;
  69 gchar *orb_argv[]={
  70                 (gchar *)captive_strdup_alloca(pname),
  71                 NULL};
  72
  73         g_return_val_if_fail(evp!=NULL,FALSE);
  74         g_return_val_if_fail(orbp!=NULL,FALSE);
  75         g_return_val_if_fail(poap!=NULL,FALSE);
  76
  77         if (done)
  78                 return TRUE;
  79
  80         /* Init 'ev' */
  81         CORBA_exception_init(evp);
  82
  83         /* Init 'orb' */
  84         *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-orb",evp);
  85         g_return_val_if_fail(*orbp!=CORBA_OBJECT_NIL,FALSE);
  86         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  87
  88         /* Init 'poa' */
  89         *poap=(PortableServer_POA)CORBA_ORB_resolve_initial_references(*orbp,"RootPOA",evp);
  90         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  91         {
  92 PortableServer_POAManager poa_mgr;
  93                 poa_mgr=PortableServer_POA__get_the_POAManager(*poap,evp);
  94                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  95                 PortableServer_POAManager_activate(poa_mgr,evp);
  96                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  97                 CORBA_Object_release((CORBA_Object)poa_mgr,evp);
  98                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  99                 }
 100
 101         g_atexit(corba_shutdown_atexit);
 102
 103         done=TRUE;
 104         return TRUE;
 105 }
 106
 107
 108 static CORBA_ORB heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 109
 110 gboolean corba_shutdown(CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
 111 {
 112 PortableServer_POA poa;
 113 CORBA_ORB orb;
 114
 115         g_return_val_if_fail(evp!=NULL,FALSE);
 116         g_return_val_if_fail(orbp!=NULL,FALSE);
 117         g_return_val_if_fail(poap!=NULL,FALSE);
 118
 119         /* Shutdown 'poa' */
 120         poa=*poap;
 121         *poap=CORBA_OBJECT_NIL;
 122         CORBA_Object_release((CORBA_Object)poa,evp);
 123         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 124
 125         /* Shutdown 'orb' */
 126         orb=*orbp;
 127         *orbp=CORBA_OBJECT_NIL;
 128         heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 129         CORBA_ORB_destroy(orb,evp);
 130         /* Do not: g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 131          * here as CORBA_ORB_destroy() sometimes reports:
 132          *      WARNING **: ORB: a total of X refs to X ORB objects were leaked
 133          */
 134         CORBA_exception_free(evp);
 135
 136         /* Shutdown 'ev' */
 137         CORBA_exception_free(evp);
 138
 139         return TRUE;
 140 }
 141
 142 static void corba_shutdown_atexit(void)
 143 {
 144 gboolean errbool;
 145
 146         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 147         g_assert(errbool==TRUE);
 148 }
 149
 150
 151 static GSource *captive_corba_sandbox_child_heartbeat_gsource;
 152
 153 #if 0   /* Currently unused - see server-Vfs.c:impl_Captive_Vfs_shutdown() */
 154 void sandbox_child_prepare_shutdown(void)
 155 {
 156         /* Prevent during shutdown: Captive-WARNING **: CORBA Exception occured: id="IDL:omg.org/CORBA/COMM_FAILURE:1.0" */
 157         if (captive_corba_sandbox_child_heartbeat_gsource) {
 158                 g_source_destroy(captive_corba_sandbox_child_heartbeat_gsource);
 159                 g_source_unref(captive_corba_sandbox_child_heartbeat_gsource);
 160                 captive_corba_sandbox_child_heartbeat_gsource=NULL;
 161                 }
 162 }
 163 #endif
 164
 165
 166 void sandbox_child_shutdown(void)
 167 {
 168         /* Do not fail by passing logging messages to the master. */
 169         impl_Captive_Vfs_init_g_log_func_disable();
 170
 171         g_main_loop_quit(linc_main_get_loop());
 172 }
 173
 174
 175 static gboolean heartbeat_source_callback(gpointer data /* unused */)
 176 {
 177         g_return_val_if_fail(heartbeat_source_callback_orb!=CORBA_OBJECT_NIL,FALSE);    /* the source should be removed */
 178
 179         sandbox_child_shutdown();
 180
 181         return FALSE;   /* the source should be removed */
 182 }
 183
 184
 185 static gboolean heartbeat_source_prepare(GSource *source,gint *timeout)
 186 {
 187         *timeout=-1;
 188
 189         return FALSE;
 190 }
 191
 192 static GPollFD heartbeat_source_check_gpollfd;
 193
 194 static gboolean heartbeat_source_check(GSource *source)
 195 {
 196         return !!(heartbeat_source_check_gpollfd.revents & HEARTBEAT_SOURCE_CHECK_REVENTS);
 197 }
 198
 199 static gboolean heartbeat_source_dispatch(GSource *source,GSourceFunc callback,gpointer user_data)
 200 {
 201         g_assert(callback!=NULL);
 202         return (*callback)(user_data);
 203 }
 204
 205 static GSourceFuncs heartbeat_source_watch_funcs={
 206                 heartbeat_source_prepare,
 207                 heartbeat_source_check,
 208                 heartbeat_source_dispatch,
 209                 NULL,   /* finalize */
 210                 };
 211
 212 void captive_corba_sandbox_child(const gchar *chrooted_orbit_dir)
 213 {
 214 Captive_Vfs Vfs_object;
 215 impl_POA_Captive_Vfs *Vfs_servant;
 216 gboolean errbool;
 217 guint errguint;
 218 int errint;
 219
 220         /* attach heartbeat_source_callback() to watch for any abnormalities
 221          * on our open pipe 'parentheart_fds' and terminate the child if parent dies.
 222          */
 223         captive_corba_sandbox_child_heartbeat_gsource=g_source_new(&heartbeat_source_watch_funcs,sizeof(GSource));
 224         g_return_if_fail(captive_corba_sandbox_child_heartbeat_gsource!=NULL);
 225         g_source_set_callback(
 226                         captive_corba_sandbox_child_heartbeat_gsource,  /* source */
 227                         heartbeat_source_callback,      /* func */
 228                         NULL,   /* data */
 229                         NULL);  /* notify */
 230         heartbeat_source_check_gpollfd.fd=0 /* STDIN */;        /* parentheart_fd_read */
 231         heartbeat_source_check_gpollfd.events=HEARTBEAT_SOURCE_CHECK_EVENTS;
 232         heartbeat_source_check_gpollfd.revents=0;
 233         g_source_add_poll(captive_corba_sandbox_child_heartbeat_gsource,&heartbeat_source_check_gpollfd);
 234
 235         errbool=corba_init("captive-sandbox-child",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 236         g_return_if_fail(errbool==TRUE);
 237
 238         heartbeat_source_callback_orb=captive_corba_orb;
 239
 240         /* linc_main_get_loop() makes sense only after corba_init() -> CORBA_ORB_init() */
 241         errguint=g_source_attach(
 242                         captive_corba_sandbox_child_heartbeat_gsource,  /* source */
 243                         g_main_loop_get_context(linc_main_get_loop())); /* context; NULL means 'default context' */
 244         g_assert(errguint!=0);
 245
 246         /* Init 'Vfs_object' */
 247         Vfs_object=impl_Captive_Vfs__create(captive_corba_poa,&captive_corba_ev);
 248         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 249
 250         /* Pass IOR to our parent.
 251          * It will also create the socket needed for 'chrooted_orbit_dir' below
 252          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 253          */
 254         {
 255 char *Vfs_IOR;
 256                 Vfs_IOR=CORBA_ORB_object_to_string(captive_corba_orb,Vfs_object,&captive_corba_ev);
 257                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 258                 g_assert(Vfs_IOR!=NULL);
 259                 errint=printf("ior=%s\n",Vfs_IOR);
 260                 g_assert(errint>=0);
 261                 CORBA_free(Vfs_IOR);
 262                 }
 263
 264         /* Default mode is 0700, permit parent non-"captive" users to access our IOR socket. */
 265         if (chrooted_orbit_dir) {
 266 DIR *dir;
 267 struct dirent *dirent;
 268 const gchar *socketname=NULL,*socketpathname;
 269
 270                 errint=chmod(chrooted_orbit_dir,0755);
 271                 g_assert(errint==0);
 272
 273                 dir=opendir(chrooted_orbit_dir);
 274                 g_assert(dir!=NULL);
 275                 while (errno=0,(dirent=readdir(dir))) {
 276                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 277                                 continue;
 278                         g_assert(socketname==NULL);
 279                         socketname=captive_strdup_alloca(dirent->d_name);
 280                         }
 281                 g_assert(errno==0);
 282                 errint=closedir(dir);
 283                 g_assert(errint==0);
 284                 g_assert(socketname!=NULL);
 285
 286                 socketpathname=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
 287                 errint=chmod(socketpathname,0666);
 288                 g_assert(errint==0);
 289
 290                 printf("socketname=%s\n",socketname);
 291                 }
 292
 293         /* Close the output to flush it to our spawning parent. */
 294         errint=fflush(stdout);
 295         g_assert(errint==0);
 296         errint=fclose(stdout);
 297         g_assert(errint==0);
 298
 299         /* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
 300          * and therefore we should be safe with glib events handling.
 301          */
 302         CORBA_ORB_run(captive_corba_orb,&captive_corba_ev);
 303         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 304
 305         /* Shutdown 'Vfs' servant */
 306         Vfs_servant=PortableServer_POA_reference_to_servant(captive_corba_poa,Vfs_object,&captive_corba_ev);
 307         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 308         CORBA_Object_release(Vfs_object,&captive_corba_ev);
 309         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 310         impl_Captive_Vfs__destroy(Vfs_servant,&captive_corba_ev);
 311         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 312
 313         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 314         g_assert(errbool==TRUE);
 315
 316         _exit(EXIT_SUCCESS);
 317 }
 318
 319
 320 static void options_module_captive_to_options_module_corba
 321                 (Captive_CaptiveOptionsModule *dest_options_module_corba,const struct captive_options_module *src_options_module_captive)
 322 {
 323         g_return_if_fail(dest_options_module_corba!=NULL);
 324         g_return_if_fail(src_options_module_captive!=NULL);
 325
 326         g_return_if_fail(src_options_module_captive->type==CAPTIVE_OPTIONS_MODULE_TYPE_PE32);
 327
 328         dest_options_module_corba->pathname_utf8=g_strdup(src_options_module_captive->pathname_utf8);
 329         dest_options_module_corba->data._buffer=g_memdup(src_options_module_captive->u.pe32.base,
 330                         src_options_module_captive->u.pe32.length);
 331         dest_options_module_corba->data._maximum=src_options_module_captive->u.pe32.length;
 332         dest_options_module_corba->data._length =src_options_module_captive->u.pe32.length;
 333         dest_options_module_corba->data._release=TRUE;
 334 }
 335
 336
 337 static const gchar *sandbox_parent_own_orbit_dir;
 338 static const gchar *sandbox_parent_own_orbit_socket;
 339
 340 gchar *sandbox_parent_read_ior(int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp)
 341 {
 342 gchar *data;
 343 gsize data_size;
 344 GHashTable *hash;
 345 gchar *ior,*child_chroot_pid_hashkey_dir;
 346 int errint;
 347 gchar *s,*sd,*se;
 348 gboolean errbool;
 349
 350         /* Initialize /tmp/orbit-$username directory for linking IOR socket. */
 351         errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 352         g_assert(errbool==TRUE);
 353
 354         /* FIXME: Security: Duplicate giop_tmpdir_init() here. */
 355         if (!sandbox_parent_own_orbit_dir) {
 356                 sandbox_parent_own_orbit_dir=g_strdup_printf("/tmp/captive-orbit-%d",getpid());
 357                 if (mkdir(sandbox_parent_own_orbit_dir,0700)) {
 358 DIR *dir;
 359 struct dirent *dirent;
 360                         g_assert(errno==EEXIST);
 361
 362                         dir=opendir(sandbox_parent_own_orbit_dir);
 363                         g_assert(dir!=NULL);
 364
 365                         while (errno=0,(dirent=readdir(dir))) {
 366 gchar *pathname;
 367                                 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 368                                         continue;
 369                                 pathname=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
 370                                 errint=unlink(pathname);
 371                                 g_assert(errint==0);
 372                                 g_free(pathname);
 373                                 }
 374                         g_assert(errno==0);
 375                         errint=closedir(dir);
 376                         g_assert(errint==0);
 377                         }
 378                 linc_set_tmpdir(sandbox_parent_own_orbit_dir);
 379                 }
 380
 381         data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
 382         errint=close(Vfs_IOR_fd_read);
 383         g_assert(errint==0);
 384         g_assert(data!=NULL);
 385         g_assert(data_size>=1);
 386         g_assert(data[data_size-1]=='\n');
 387
 388         hash=g_hash_table_new(g_str_hash,g_str_equal);
 389
 390         for (s=data;s<data+data_size;s=se+1) {
 391                 se=strchr(s,'\n');
 392                 g_assert(se!=NULL);
 393                 *se=0;
 394                 sd=strchr(s,'=');
 395                 g_assert(sd!=NULL);
 396                 *sd=0;
 397                 g_hash_table_insert(hash,s,sd+1);
 398                 }
 399         g_assert(s==data+data_size);
 400
 401         if ((child_chroot_pid_hashkey_dir=g_hash_table_lookup(hash,"chroot_pid_hashkey_dir"))) {
 402 const gchar *socketname,*socketpathname_src,*socketpathname_dest;
 403 const gchar *chrooted_orbit_dir;
 404
 405                 /* IOR contains the full pathname with the setuid username encoded. */
 406                 chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
 407                 g_assert(chrooted_orbit_dir!=NULL);
 408                 if (mkdir(chrooted_orbit_dir,S_ISVTX|0777)) {
 409                         g_assert(errno==EEXIST);
 410                         }
 411
 412                 socketname=g_hash_table_lookup(hash,"socketname");
 413                 g_assert(socketname!=NULL);
 414
 415                 socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
 416                 socketpathname_dest=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
 417                 errint=link(socketpathname_src,socketpathname_dest);
 418                 g_assert(errint==0);
 419                 }
 420         if (child_chroot_pid_hashkey_dirp)
 421                 *child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
 422
 423         ior=g_hash_table_lookup(hash,"ior");
 424         g_assert(ior!=NULL);
 425         ior=g_strdup(ior);
 426         g_free(data);
 427
 428         g_hash_table_destroy(hash);
 429
 430         return ior;
 431 }
 432
 433
 434 static void sandbox_parent(const gchar *Vfs_IOR,const gchar *child_chroot_pid_hashkey_dir,CaptiveVfsObject *captive_vfs_object)
 435 {
 436 Captive_Vfs Vfs_object;
 437 Captive_GLogFunc GLogFunc_object;
 438 Captive_CaptiveIOChannel CaptiveIOChannel_object;
 439 Captive_CaptiveOptions options_corba;
 440 guint load_module_length,load_moduleui;
 441 struct captive_options_module *options_module;
 442 GList *load_module_node;
 443 const gchar *child_chroot_parent_own_orbit_socket,*child_chroot_parent_own_orbit_dir;
 444 int errint;
 445
 446         g_return_if_fail(Vfs_IOR!=NULL);
 447         /* 'child_chroot_pid_hashkey_dir' may be NULL */
 448         g_return_if_fail(captive_vfs_object!=NULL);
 449
 450         Vfs_object=CORBA_ORB_string_to_object(captive_corba_orb,Vfs_IOR,&captive_corba_ev);
 451         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 452
 453         /* Init 'GLogFunc_object' */
 454         GLogFunc_object=impl_Captive_GLogFunc__create(captive_corba_poa,&captive_corba_ev);
 455         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 456
 457         /* Init 'CaptiveIOChannel_object' */
 458         if (!captive_vfs_object->corba_parent_giochanel_blind_source)
 459                 switch (captive_vfs_object->options.rwmode) {
 460                         case CAPTIVE_OPTION_RWMODE_RO:
 461                         case CAPTIVE_OPTION_RWMODE_RW:
 462                                 captive_vfs_object->corba_parent_giochanel_blind_source=captive_vfs_object->options.image_iochannel;
 463                                 break;
 464                         case CAPTIVE_OPTION_RWMODE_BLIND:
 465                                 captive_vfs_object->corba_parent_giochanel_blind_source=(GIOChannel *)captive_giochannel_blind_new(
 466                                                 captive_vfs_object->options.image_iochannel,    /* giochannel_orig */
 467                                                 TRUE); /* writeable */
 468                                 break;
 469                         default: g_assert_not_reached();
 470                         }
 471         if (!captive_vfs_object->corba_parent_giochanel_blind)
 472                 captive_vfs_object->corba_parent_giochanel_blind=(GIOChannel *)captive_giochannel_blind_new(
 473                                 captive_vfs_object->corba_parent_giochanel_blind_source,  /* giochannel_orig */
 474                                 (captive_vfs_object->options.rwmode!=CAPTIVE_OPTION_RWMODE_RO)); /* writeable */
 475         CaptiveIOChannel_object=impl_Captive_CaptiveIOChannel__create(captive_corba_poa,
 476                         captive_vfs_object->corba_parent_giochanel_blind,&captive_corba_ev);
 477         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 478
 479         /* Create the socket needed for 'sandbox_parent_own_orbit_socket' below
 480          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 481          */
 482         {
 483 char *GLogFunc_IOR;
 484                 GLogFunc_IOR=CORBA_ORB_object_to_string(captive_corba_orb,GLogFunc_object,&captive_corba_ev);
 485                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 486                 g_assert(GLogFunc_IOR!=NULL);
 487                 CORBA_free(GLogFunc_IOR);
 488                 }
 489
 490         if (sandbox_parent_own_orbit_dir && !sandbox_parent_own_orbit_socket) {
 491 DIR *dir;
 492 struct dirent *dirent;
 493
 494                 dir=opendir(sandbox_parent_own_orbit_dir);
 495                 g_assert(dir!=NULL);
 496
 497                 while (errno=0,(dirent=readdir(dir))) {
 498                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 499                                 continue;
 500                         g_assert(sandbox_parent_own_orbit_socket==NULL);
 501                         sandbox_parent_own_orbit_socket=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
 502                         }
 503                 g_assert(errno==0);
 504                 errint=closedir(dir);
 505                 g_assert(errint==0);
 506                 g_assert(sandbox_parent_own_orbit_socket!=NULL);
 507                 }
 508
 509         if (child_chroot_pid_hashkey_dir) {
 510                 child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
 511                 errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
 512                 g_assert(errint==0);
 513                 child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
 514                                 child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
 515                 errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
 516                 g_assert(errint==0);
 517                 /* chmod(2)s also our orig. one (!) but this one is protected by its 0777 directory. */
 518                 errint=chmod(child_chroot_parent_own_orbit_socket,0666);
 519                 g_assert(errint==0);
 520                 }
 521
 522         options_corba.g_log_func=GLogFunc_object;
 523         options_module_captive_to_options_module_corba(&options_corba.filesystem,&captive_vfs_object->options.filesystem);
 524         /* Prevent secondary captive_giochannel_blind inside of our sandbox child
 525          * as we already have one captive_giochannel_blind in the parent.
 526          */
 527         options_corba.rwmode        =(captive_vfs_object->options.rwmode == CAPTIVE_OPTION_RWMODE_BLIND ? CAPTIVE_OPTION_RWMODE_RW
 528                         : captive_vfs_object->options.rwmode);
 529         options_corba.media         =captive_vfs_object->options.media;
 530         options_corba.debug_messages=captive_vfs_object->options.debug_messages;
 531         options_corba.image_iochannel=CaptiveIOChannel_object;
 532
 533         load_module_length=g_list_length(captive_vfs_object->options.load_module);
 534         captive_newn(options_corba.load_module._buffer,load_module_length);
 535         options_corba.load_module._maximum=load_module_length;
 536         options_corba.load_module._length=load_module_length;
 537         options_corba.load_module._release=TRUE;
 538         for (load_moduleui=0,load_module_node=captive_vfs_object->options.load_module;
 539                         load_module_node;
 540                         load_moduleui++,load_module_node=load_module_node->next) {
 541                 options_module=load_module_node->data;
 542                 options_module_captive_to_options_module_corba(options_corba.load_module._buffer+load_moduleui,options_module);
 543                 }
 544
 545         Captive_Vfs_init(Vfs_object,&options_corba,&captive_corba_ev);
 546         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 547
 548         /* FIXME: Free 'options_corba' - LEAK */
 549
 550         captive_vfs_object->corba_Vfs_object=Vfs_object;
 551         captive_vfs_object->corba_GLogFunc_object=GLogFunc_object;
 552         captive_vfs_object->corba_CaptiveIOChannel_object=CaptiveIOChannel_object;
 553 }
 554
 555 static void fd_shiftup(int *fdp)
 556 {
 557         g_return_if_fail(fdp!=NULL);
 558
 559         while (*fdp<=2 /* STDERR */) {
 560                 *fdp=dup(*fdp);
 561                 g_assert(*fdp!=-1);
 562                 }
 563 }
 564
 565 void captive_sandbox_fd_closeup(int fd_first_to_delete)
 566 {
 567 DIR *dir;
 568 int errint;
 569 int dir_fd;
 570 struct dirent *dirent;
 571
 572         dir=opendir("/proc/self/fd/");
 573         g_return_if_fail(dir!=NULL);
 574         dir_fd=dirfd(dir);
 575         g_return_if_fail(dir_fd!=-1);
 576
 577         while (errno=0,(dirent=readdir(dir))) {
 578 long dirent_fd;
 579 char *endptr;
 580
 581                 if (0
 582                                 || !strcmp(dirent->d_name,".")
 583                                 || !strcmp(dirent->d_name,".."))
 584                         continue;
 585                 dirent_fd=strtol(dirent->d_name,&endptr,10 /* base */);
 586                 g_assert(dirent_fd>=0 && (!endptr || !*endptr));
 587                 if (dirent_fd<fd_first_to_delete || dirent_fd==dir_fd)
 588                         continue;
 589
 590                 errint=close(dirent_fd);
 591                 g_assert(errint==0);
 592                 errno=0;
 593                 errint=close(dirent_fd);
 594                 g_assert(errint==-1); g_assert(errno==EBADF);
 595                 }
 596         g_return_if_fail(errno==0);     /* check for EOF */
 597
 598         errint=closedir(dir);
 599         g_return_if_fail(errint==0);
 600         errno=0;
 601         close(dir_fd); g_assert(errno==EBADF);  /* just a bit of paranoia; it should be already closed by closedir() */
 602 }
 603
 604 gboolean captive_sandbox_spawn(CaptiveVfsObject *captive_vfs_object)
 605 {
 606 /* Vfs_IOR_fds[0] for reading by sandbox_parent() - client,
 607  * Vfs_IOR_fds[1] for writing by sandbox_child()  - server
 608  */
 609 int Vfs_IOR_fds[2],parentheart_fds[2];
 610 int errint;
 611 gboolean errbool;
 612
 613         g_return_val_if_fail(captive_vfs_object!=NULL,FALSE);
 614
 615         errint=pipe(Vfs_IOR_fds);
 616         g_return_val_if_fail(errint==0,FALSE);
 617         errint=pipe(parentheart_fds);
 618         g_return_val_if_fail(errint==0,FALSE);
 619
 620         /* Currently never called anywhere:
 621          *     errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 622          *     g_assert(errbool==TRUE);
 623          */
 624
 625         if (captive_vfs_object->options.sandbox_server_ior) {
 626                 g_assert(captive_vfs_object->options.sandbox_server_argv==NULL);
 627
 628                 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 629                 g_assert(errbool==TRUE);
 630
 631                 captive_vfs_object->corba_parentheart_fds_1=-1;
 632                 captive_vfs_object->corba_child_pid=-1;
 633                 sandbox_parent(
 634                                 captive_vfs_object->options.sandbox_server_ior, /* Vfs_IOR */
 635                                 NULL,   /* child_chroot_pid_hashkey_dir */
 636                                 captive_vfs_object);    /* captive_vfs_object */
 637                 return TRUE;
 638                 }
 639
 640         g_assert(captive_vfs_object->options.sandbox_server_argv!=NULL);
 641         switch ((captive_vfs_object->corba_child_pid=fork())) {
 642                 case -1:        /* error */
 643                         g_return_val_if_reached(FALSE);
 644
 645                 case 0: { /* child */
 646
 647                         errint=close(Vfs_IOR_fds[0]);   /* close Vfs_IOR_fd_read */
 648                         g_return_val_if_fail(errint==0,FALSE);
 649                         errint=close(parentheart_fds[1]);       /* close parentheart_fd_write */
 650                         g_return_val_if_fail(errint==0,FALSE);
 651
 652                         fd_shiftup(Vfs_IOR_fds+1);      /* Vfs_IOR_fd_write */
 653                         fd_shiftup(parentheart_fds+0);  /* parentheart_fd_read */
 654                         errint=dup2(Vfs_IOR_fds[1],1 /* STDOUT */);     /* Vfs_IOR_fd_write */
 655                         g_return_val_if_fail(errint==1 /* STDOUT */,FALSE);
 656                         errint=dup2(parentheart_fds[0],0 /* STDIN */);  /* parentheart_fd_read */
 657                         g_return_val_if_fail(errint==0 /* STDIN */,FALSE);
 658
 659                         captive_sandbox_fd_closeup(2 /* STDERR */ +1);
 660
 661                         execv(captive_vfs_object->options.sandbox_server_argv[0],
 662                                         /* re-const */ (char * const *)captive_vfs_object->options.sandbox_server_argv);
 663                         g_return_val_if_reached(FALSE);
 664                         } /* NOTREACHED */
 665
 666                 default: {      /* parent */
 667 gchar *Vfs_IOR;
 668 gchar *child_chroot_pid_hashkey_dir;
 669
 670                         errint=close(Vfs_IOR_fds[1]);   /* close Vfs_IOR_fd_write */
 671                         g_return_val_if_fail(errint==0,FALSE);
 672                         errint=close(parentheart_fds[0]);       /* close parentheart_fd_read */
 673                         g_return_val_if_fail(errint==0,FALSE);
 674                         errint=fcntl(parentheart_fds[1],F_SETFD,FD_CLOEXEC);
 675                         /* This fcntl(2) may not be enough - some fork(2) may duplicate this
 676                          * write descriptor and even if we do some process finish the child
 677                          * may remain alone connected with some unknown fork(2)er from us.
 678                          * Currently I am not aware such case would occur.
 679                          */
 680                         g_return_val_if_fail(errint==0,FALSE);
 681                         captive_vfs_object->corba_parentheart_fds_1=parentheart_fds[1];
 682
 683                         Vfs_IOR=sandbox_parent_read_ior(
 684                                         Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
 685                                         &child_chroot_pid_hashkey_dir);
 686
 687                         sandbox_parent(
 688                                         Vfs_IOR,        /* Vfs_IOR */
 689                                         child_chroot_pid_hashkey_dir,   /* child_chroot_pid_hashkey_dir */
 690                                         captive_vfs_object);    /* captive_vfs_object */
 691
 692                         g_free(Vfs_IOR);
 693                         g_free(child_chroot_pid_hashkey_dir);
 694
 695                         /* 'parentheart_fds[1]' - parentheart_fd_write - is left open here */
 696                         return TRUE;
 697                         }
 698                 }
 699         /* NOTREACHED */
 700         g_return_val_if_reached(FALSE);
 701 }
 702
 703
 704 GnomeVFSResult captive_sandbox_parent_return_from_CORBA_Environment(CORBA_Environment *evp)
 705 {
 706 GnomeVFSResult r;
 707
 708         if (evp->_major==CORBA_NO_EXCEPTION)
 709                 return GNOME_VFS_OK;
 710
 711         if (evp->_major==CORBA_USER_EXCEPTION && !strcmp(ex_Captive_GnomeVFSResultException,CORBA_exception_id(evp)))
 712                 r=((Captive_GnomeVFSResultException *)CORBA_exception_value(evp))->gnome_vfs_result;
 713         else {
 714                 r=GNOME_VFS_ERROR_GENERIC;
 715                 g_warning(_("CORBA Exception occured: id=\"%s\", value=%p"),
 716                                 CORBA_exception_id(evp),CORBA_exception_value(evp));
 717                 }
 718         CORBA_exception_free(evp);
 719
 720         return r;
 721 }
 722
 723
 724 gboolean captive_sandbox_parent_query_vfs_retry(CORBA_Environment *evp,CaptiveVfsObject *captive_vfs_object)
 725 {
 726 GnomeVFSResult errvfsresult;
 727 gboolean want_retry;
 728
 729         g_return_val_if_fail(evp!=NULL,FALSE);
 730         g_return_val_if_fail(captive_vfs_object!=NULL,FALSE);
 731
 732         /* If !captive_vfs_object->options.sandbox_server_argv it is captive_vfs_object->options.sandbox_server_ior
 733          * where we cannot do any restart anyway.
 734          */
 735         want_retry=(captive_vfs_object->options.sandbox_server_argv
 736                         && (evp->_major==CORBA_SYSTEM_EXCEPTION && !strcmp(ex_CORBA_COMM_FAILURE,CORBA_exception_id(evp))));
 737         CORBA_exception_free(evp);
 738         if (!want_retry)
 739                 return FALSE;   /* no retry */
 740
 741         captive_sandbox_parent_vfs_close(captive_vfs_object);   /* errors ignored */
 742         errvfsresult=captive_sandbox_parent_vfs_new(captive_vfs_object);
 743
 744         return errvfsresult==GNOME_VFS_OK;      /* retry if restart succeeded */
 745 }
 746
 747
 748 void captive_sandbox_child_GnomeVFSResultException_throw(CORBA_Environment *evp,GnomeVFSResult errvfsresult)
 749 {
 750 Captive_GnomeVFSResultException *gnome_vfs_result_exception;
 751
 752         g_return_if_fail(evp!=NULL);
 753
 754         gnome_vfs_result_exception=Captive_GnomeVFSResultException__alloc();
 755         gnome_vfs_result_exception->gnome_vfs_result=errvfsresult;
 756         CORBA_exception_set(evp,CORBA_USER_EXCEPTION,ex_Captive_GnomeVFSResultException,gnome_vfs_result_exception);
 757 }