src/libcaptive/sandbox/split.c

   1 /* $Id$
   2  * Connection of captive-vfs interface through CORBA/ORBit
   3  * Copyright (C) 2002 Jan Kratochvil <project-captive@jankratochvil.net>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; exactly version 2 of June 1991 is required
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  17  */
  18
  19
  20 #include "config.h"
  21
  22 #include "split.h"      /* self */
  23 #include "sandbox.h"
  24 #include "server-GLogFunc.h"
  25 #include "captive/macros.h"
  26 #include <glib/gmacros.h>
  27 #include <stdlib.h>
  28 #include "captive/rtl-file.h"
  29 #include <unistd.h>
  30 #include <fcntl.h>
  31 #include <linc/linc.h>  /* for linc_main_get_loop() */
  32 #include "server-Directory.h"
  33 #include "server-Vfs.h"
  34 #include "../client/vfs.h"
  35 #include "parent-Vfs.h"
  36 #include <dirent.h>
  37 #include "server-CaptiveIOChannel.h"
  38 #include <errno.h>
  39 #include "../client/giochannel-blind.h" /* for captive_giochannel_blind_new() */
  40 #include <signal.h>
  41
  42
  43 /* CONFIG: */
  44
  45 #define HEARTBEAT_SOURCE_CHECK_EVENTS (G_IO_IN|G_IO_PRI)
  46 #define HEARTBEAT_SOURCE_CHECK_REVENTS (HEARTBEAT_SOURCE_CHECK_EVENTS|G_IO_ERR|G_IO_HUP|G_IO_NVAL)
  47
  48
  49 gboolean validate_CORBA_Environment(CORBA_Environment *evp)
  50 {
  51         if (evp->_major==CORBA_NO_EXCEPTION)
  52                 return TRUE;
  53
  54         g_error(_("CORBA Exception occured: id=\"%s\", value=%p"),
  55                         CORBA_exception_id(evp),CORBA_exception_value(evp));
  56         CORBA_exception_free(evp);
  57         return FALSE;
  58 }
  59
  60 CORBA_Environment captive_corba_ev;
  61 CORBA_ORB captive_corba_orb;
  62 PortableServer_POA captive_corba_poa;
  63
  64 static void corba_shutdown_atexit(void);
  65
  66 static gboolean corba_init(const char *pname,CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
  67 {
  68 static gboolean done=FALSE;
  69 int orb_argc=1;
  70 gchar *orb_argv[]={
  71                 (gchar *)captive_strdup_alloca(pname),
  72                 NULL};
  73
  74         g_return_val_if_fail(evp!=NULL,FALSE);
  75         g_return_val_if_fail(orbp!=NULL,FALSE);
  76         g_return_val_if_fail(poap!=NULL,FALSE);
  77
  78         if (done)
  79                 return TRUE;    /* FIXME: '*poap' is left invalid! */
  80
  81         /* Init 'ev' */
  82         CORBA_exception_init(evp);
  83
  84         /* Init 'orb' */
  85         *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-orb",evp);
  86         g_return_val_if_fail(*orbp!=CORBA_OBJECT_NIL,FALSE);
  87         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  88
  89         /* Init 'poa' */
  90         *poap=(PortableServer_POA)CORBA_ORB_resolve_initial_references(*orbp,"RootPOA",evp);
  91         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  92         {
  93 PortableServer_POAManager poa_mgr;
  94                 poa_mgr=PortableServer_POA__get_the_POAManager(*poap,evp);
  95                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  96                 PortableServer_POAManager_activate(poa_mgr,evp);
  97                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
  98                 CORBA_Object_release((CORBA_Object)poa_mgr,evp);
  99                 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 100                 }
 101
 102         g_atexit(corba_shutdown_atexit);
 103
 104         done=TRUE;
 105         return TRUE;
 106 }
 107
 108
 109 static CORBA_ORB heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 110
 111 gboolean corba_shutdown(CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
 112 {
 113 PortableServer_POA poa;
 114 CORBA_ORB orb;
 115
 116         g_return_val_if_fail(evp!=NULL,FALSE);
 117         g_return_val_if_fail(orbp!=NULL,FALSE);
 118         g_return_val_if_fail(poap!=NULL,FALSE);
 119
 120         /* Shutdown 'poa' */
 121         poa=*poap;
 122         *poap=CORBA_OBJECT_NIL;
 123         CORBA_Object_release((CORBA_Object)poa,evp);
 124         g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 125
 126         /* Shutdown 'orb' */
 127         orb=*orbp;
 128         *orbp=CORBA_OBJECT_NIL;
 129         heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
 130         CORBA_ORB_destroy(orb,evp);
 131         /* Do not: g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
 132          * here as CORBA_ORB_destroy() sometimes reports:
 133          *      WARNING **: ORB: a total of X refs to X ORB objects were leaked
 134          */
 135         CORBA_exception_free(evp);
 136
 137         /* Shutdown 'ev' */
 138         CORBA_exception_free(evp);
 139
 140         return TRUE;
 141 }
 142
 143 static void sandbox_parent_own_orbit_dir_cleanup_atexit(void);
 144
 145 static void corba_shutdown_atexit(void)
 146 {
 147 gboolean errbool;
 148
 149         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 150         g_assert(errbool==TRUE);
 151
 152         /* Delete the CORBA ORB socket directory only after full CORBA ORB shutdown. */
 153         sandbox_parent_own_orbit_dir_cleanup_atexit();
 154 }
 155
 156
 157 static GSource *captive_corba_sandbox_child_heartbeat_gsource;
 158
 159 #if 0   /* Currently unused - see server-Vfs.c:impl_Captive_Vfs_shutdown() */
 160 void sandbox_child_prepare_shutdown(void)
 161 {
 162         /* Prevent during shutdown: Captive-WARNING **: CORBA Exception occured: id="IDL:omg.org/CORBA/COMM_FAILURE:1.0" */
 163         if (captive_corba_sandbox_child_heartbeat_gsource) {
 164                 g_source_destroy(captive_corba_sandbox_child_heartbeat_gsource);
 165                 g_source_unref(captive_corba_sandbox_child_heartbeat_gsource);
 166                 captive_corba_sandbox_child_heartbeat_gsource=NULL;
 167                 }
 168 }
 169 #endif
 170
 171
 172 void sandbox_child_shutdown(void)
 173 {
 174         /* Do not fail by passing logging messages to the master. */
 175         impl_Captive_Vfs_init_g_log_func_disable();
 176
 177         g_main_loop_quit(linc_main_get_loop());
 178 }
 179
 180
 181 static gboolean heartbeat_source_callback(gpointer data /* unused */)
 182 {
 183         g_return_val_if_fail(heartbeat_source_callback_orb!=CORBA_OBJECT_NIL,FALSE);    /* the source should be removed */
 184
 185         sandbox_child_shutdown();
 186
 187         return FALSE;   /* the source should be removed */
 188 }
 189
 190
 191 static gboolean heartbeat_source_prepare(GSource *source,gint *timeout)
 192 {
 193         *timeout=-1;
 194
 195         return FALSE;
 196 }
 197
 198 static GPollFD heartbeat_source_check_gpollfd;
 199
 200 static gboolean heartbeat_source_check(GSource *source)
 201 {
 202         return !!(heartbeat_source_check_gpollfd.revents & HEARTBEAT_SOURCE_CHECK_REVENTS);
 203 }
 204
 205 static gboolean heartbeat_source_dispatch(GSource *source,GSourceFunc callback,gpointer user_data)
 206 {
 207         g_assert(callback!=NULL);
 208         return (*callback)(user_data);
 209 }
 210
 211 static GSourceFuncs heartbeat_source_watch_funcs={
 212                 heartbeat_source_prepare,
 213                 heartbeat_source_check,
 214                 heartbeat_source_dispatch,
 215                 NULL,   /* finalize */
 216                 };
 217
 218 void captive_corba_sandbox_child(const gchar *chrooted_orbit_dir)
 219 {
 220 Captive_Vfs Vfs_object;
 221 impl_POA_Captive_Vfs *Vfs_servant;
 222 gboolean errbool;
 223 guint errguint;
 224 int errint;
 225
 226         /* attach heartbeat_source_callback() to watch for any abnormalities
 227          * on our open pipe 'parentheart_fds' and terminate the child if parent dies.
 228          */
 229         captive_corba_sandbox_child_heartbeat_gsource=g_source_new(&heartbeat_source_watch_funcs,sizeof(GSource));
 230         g_return_if_fail(captive_corba_sandbox_child_heartbeat_gsource!=NULL);
 231         g_source_set_callback(
 232                         captive_corba_sandbox_child_heartbeat_gsource,  /* source */
 233                         heartbeat_source_callback,      /* func */
 234                         NULL,   /* data */
 235                         NULL);  /* notify */
 236         heartbeat_source_check_gpollfd.fd=0 /* STDIN */;        /* parentheart_fd_read */
 237         heartbeat_source_check_gpollfd.events=HEARTBEAT_SOURCE_CHECK_EVENTS;
 238         heartbeat_source_check_gpollfd.revents=0;
 239         g_source_add_poll(captive_corba_sandbox_child_heartbeat_gsource,&heartbeat_source_check_gpollfd);
 240
 241         errbool=corba_init("captive-sandbox-child",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 242         g_return_if_fail(errbool==TRUE);
 243
 244         heartbeat_source_callback_orb=captive_corba_orb;
 245
 246         /* linc_main_get_loop() makes sense only after corba_init() -> CORBA_ORB_init() */
 247         errguint=g_source_attach(
 248                         captive_corba_sandbox_child_heartbeat_gsource,  /* source */
 249                         g_main_loop_get_context(linc_main_get_loop())); /* context; NULL means 'default context' */
 250         g_assert(errguint!=0);
 251
 252         /* Init 'Vfs_object' */
 253         Vfs_object=impl_Captive_Vfs__create(captive_corba_poa,&captive_corba_ev);
 254         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 255
 256         /* Pass IOR to our parent.
 257          * It will also create the socket needed for 'chrooted_orbit_dir' below
 258          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 259          */
 260         {
 261 char *Vfs_IOR;
 262                 Vfs_IOR=CORBA_ORB_object_to_string(captive_corba_orb,Vfs_object,&captive_corba_ev);
 263                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 264                 g_assert(Vfs_IOR!=NULL);
 265                 errint=printf("ior=%s\n",Vfs_IOR);
 266                 g_assert(errint>=0);
 267                 CORBA_free(Vfs_IOR);
 268                 }
 269
 270         /* Default mode is 0700, permit parent non-"captive" users to access our IOR socket. */
 271         if (chrooted_orbit_dir) {
 272 DIR *dir;
 273 struct dirent *dirent;
 274 const gchar *socketname=NULL,*socketpathname;
 275
 276                 errint=chmod(chrooted_orbit_dir,0755);
 277                 g_assert(errint==0);
 278
 279                 dir=opendir(chrooted_orbit_dir);
 280                 g_assert(dir!=NULL);
 281                 while (errno=0,(dirent=readdir(dir))) {
 282                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 283                                 continue;
 284                         g_assert(socketname==NULL);
 285                         socketname=captive_strdup_alloca(dirent->d_name);
 286                         }
 287                 g_assert(errno==0);
 288                 errint=closedir(dir);
 289                 g_assert(errint==0);
 290                 g_assert(socketname!=NULL);
 291
 292                 socketpathname=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
 293                 errint=chmod(socketpathname,0666);
 294                 g_assert(errint==0);
 295
 296                 printf("socketname=%s\n",socketname);
 297                 }
 298
 299         /* Close the output to flush it to our spawning parent. */
 300         errint=fflush(stdout);
 301         g_assert(errint==0);
 302         errint=fclose(stdout);
 303         g_assert(errint==0);
 304
 305         /* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
 306          * and therefore we should be safe with glib events handling.
 307          */
 308         CORBA_ORB_run(captive_corba_orb,&captive_corba_ev);
 309         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 310
 311         /* Shutdown 'Vfs' servant */
 312         Vfs_servant=PortableServer_POA_reference_to_servant(captive_corba_poa,Vfs_object,&captive_corba_ev);
 313         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 314         CORBA_Object_release(Vfs_object,&captive_corba_ev);
 315         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 316         impl_Captive_Vfs__destroy(Vfs_servant,&captive_corba_ev);
 317         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 318
 319         errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 320         g_assert(errbool==TRUE);
 321
 322         _exit(EXIT_SUCCESS);
 323 }
 324
 325
 326 static void options_module_captive_to_options_module_corba
 327                 (Captive_CaptiveOptionsModule *dest_options_module_corba,const struct captive_options_module *src_options_module_captive)
 328 {
 329         g_return_if_fail(dest_options_module_corba!=NULL);
 330         g_return_if_fail(src_options_module_captive!=NULL);
 331
 332         g_return_if_fail(src_options_module_captive->type==CAPTIVE_OPTIONS_MODULE_TYPE_PE32);
 333
 334         dest_options_module_corba->pathname_utf8=g_strdup(src_options_module_captive->pathname_utf8);
 335         dest_options_module_corba->data._buffer=g_memdup(src_options_module_captive->u.pe32.base,
 336                         src_options_module_captive->u.pe32.length);
 337         dest_options_module_corba->data._maximum=src_options_module_captive->u.pe32.length;
 338         dest_options_module_corba->data._length =src_options_module_captive->u.pe32.length;
 339         dest_options_module_corba->data._release=TRUE;
 340 }
 341
 342 static void unlink_nonrecursive(const gchar *dirname)
 343 {
 344 DIR *dir;
 345 struct dirent *dirent;
 346 int errint;
 347
 348         dir=opendir(dirname);
 349         g_assert(dir!=NULL);
 350
 351         while (errno=0,(dirent=readdir(dir))) {
 352 gchar *pathname;
 353
 354                 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 355                         continue;
 356                 pathname=g_strdup_printf("%s/%s",dirname,dirent->d_name);
 357                 errint=unlink(pathname);
 358                 g_assert(errint==0);
 359                 g_free(pathname);
 360                 }
 361         g_assert(errno==0);
 362         errint=closedir(dir);
 363         g_assert(errint==0);
 364         errint=rmdir(dirname);
 365         g_assert(errint==0);
 366 }
 367
 368 static const gchar *sandbox_parent_own_orbit_dir;
 369 static const gchar *sandbox_parent_own_orbit_socket;
 370
 371 static void sandbox_parent_own_orbit_dir_cleanup_atexit(void)
 372 {
 373 static gboolean done=FALSE;
 374
 375         /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s; done=%d",G_STRLOC,(int)done);
 376          * as any memory allocation is not permitted for atexit functions.
 377          */
 378         if (done)
 379                 return;
 380         done=TRUE;
 381
 382         if (sandbox_parent_own_orbit_dir)
 383                 unlink_nonrecursive(sandbox_parent_own_orbit_dir);
 384 }
 385
 386 static struct sandbox_parent_own_orbit_dir_cleanup_signal {
 387         int signum;
 388         /* FIXME: Why we cannot use 'sighandler_t'? */ void (*sighandler_orig)(int signum);
 389         } sandbox_parent_own_orbit_dir_cleanup_signals[]={
 390                 { SIGINT  },
 391                 { SIGQUIT },
 392                 { SIGTERM },
 393                 { SIGHUP  },
 394                 { SIGABRT },
 395                 { SIGFPE  },
 396                 };
 397
 398 static void sandbox_parent_own_orbit_dir_cleanup_sighandler(int signum)
 399 {
 400 struct sandbox_parent_own_orbit_dir_cleanup_signal *sigstructp;
 401
 402         for (
 403                         sigstructp=sandbox_parent_own_orbit_dir_cleanup_signals;
 404                         sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals);
 405                         sigstructp++) {
 406                 if (sigstructp->signum==signum)
 407                         break;
 408                 }
 409         g_assert(sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals));
 410         signal(signum,sigstructp->sighandler_orig);
 411
 412         /* Prevent recursive fatal logging before signal restore: */
 413         /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: signum=%d,sighandler_orig=%p",G_STRLOC,signum,sigstructp->sighandler_orig);
 414          * as it is dangerous to g_log() from sighandler.
 415          */
 416
 417         sandbox_parent_own_orbit_dir_cleanup_atexit();
 418
 419         /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: re-raising...",G_STRLOC);
 420          * as it is dangerous to g_log() from sighandler.
 421          */
 422         raise(signum);
 423 }
 424
 425 static void sandbox_parent_own_orbit_dir_cleanup_init(void)
 426 {
 427 struct sandbox_parent_own_orbit_dir_cleanup_signal *sigstructp;
 428
 429         for (
 430                         sigstructp=sandbox_parent_own_orbit_dir_cleanup_signals;
 431                         sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals);
 432                         sigstructp++) {
 433                 sigstructp->sighandler_orig=signal(sigstructp->signum,sandbox_parent_own_orbit_dir_cleanup_sighandler);
 434                 if (sigstructp->sighandler_orig==SIG_IGN)
 435                         sigstructp->sighandler_orig=SIG_DFL;
 436                 }
 437 }
 438
 439 static gchar *sandbox_parent_read_ior
 440                 (int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp,CaptiveVfsParentObject *captive_vfs_parent_object)
 441 {
 442 gchar *data;
 443 gsize data_size;
 444 GHashTable *hash;
 445 gchar *ior,*child_chroot_pid_hashkey_dir;
 446 int errint;
 447 gchar *s,*sd,*se;
 448 gboolean errbool;
 449
 450         /* Initialize /tmp/orbit-$username directory for linking IOR socket. */
 451         errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 452         g_assert(errbool==TRUE);
 453
 454         /* FIXME: Security: Duplicate giop_tmpdir_init() here. */
 455         if (!sandbox_parent_own_orbit_dir) {
 456                 /* FIXME: Make 'CAPTIVE_SANDBOX_CHROOT' configurable. */
 457                 sandbox_parent_own_orbit_dir=g_strdup_printf("%s/tmp/captive-orbit-%d",CAPTIVE_SANDBOX_CHROOT,getpid());
 458                 if (mkdir(sandbox_parent_own_orbit_dir,0700)) {
 459                         g_assert(errno==EEXIST);
 460                         sandbox_parent_own_orbit_dir_cleanup_init();
 461                         unlink_nonrecursive(sandbox_parent_own_orbit_dir);
 462                         if (mkdir(sandbox_parent_own_orbit_dir,0700))
 463                                 g_assert_not_reached();
 464                         }
 465                 sandbox_parent_own_orbit_dir_cleanup_init();
 466                 linc_set_tmpdir(sandbox_parent_own_orbit_dir);
 467                 }
 468
 469         data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
 470         errint=close(Vfs_IOR_fd_read);
 471         g_assert(errint==0);
 472         g_assert(data!=NULL);
 473         g_assert(data_size>=1);
 474         g_assert(data[data_size-1]=='\n');
 475
 476         hash=g_hash_table_new(g_str_hash,g_str_equal);
 477
 478         for (s=data;s<data+data_size;s=se+1) {
 479                 se=strchr(s,'\n');
 480                 g_assert(se!=NULL);
 481                 *se=0;
 482                 sd=strchr(s,'=');
 483                 g_assert(sd!=NULL);
 484                 *sd=0;
 485                 g_hash_table_insert(hash,s,sd+1);
 486                 }
 487         g_assert(s==data+data_size);
 488
 489         if ((child_chroot_pid_hashkey_dir=g_hash_table_lookup(hash,"chroot_pid_hashkey_dir"))) {
 490 const gchar *socketname,*socketpathname_src,*socketpathname_dest;
 491 const gchar *chrooted_orbit_dir;
 492
 493                 /* IOR contains the full pathname with the setuid username encoded. */
 494                 chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
 495                 g_assert(chrooted_orbit_dir!=NULL);
 496                 captive_vfs_parent_object->corba_chrooted_orbit_dir=g_strdup(chrooted_orbit_dir);
 497                 /* 0700 as this directory will not be reused
 498                  * to commuicate with any other sandbox child.
 499                  */
 500                 if (mkdir(chrooted_orbit_dir,0700)) {
 501                         g_assert(errno==EEXIST);
 502                         }
 503
 504                 socketname=g_hash_table_lookup(hash,"socketname");
 505                 g_assert(socketname!=NULL);
 506                 captive_vfs_parent_object->corba_socketname=g_strdup(socketname);
 507
 508                 socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
 509                 socketpathname_dest=g_strdup_printf("%s/%s",chrooted_orbit_dir,socketname);
 510                 errint=link(socketpathname_src,socketpathname_dest);
 511                 if (errint)
 512                         g_error("link(\"%s\",\"%s\")=%d:%m",socketpathname_src,socketpathname_dest,errint);
 513                 }
 514         if (child_chroot_pid_hashkey_dirp)
 515                 *child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
 516
 517         ior=g_hash_table_lookup(hash,"ior");
 518         g_assert(ior!=NULL);
 519         ior=g_strdup(ior);
 520         g_free(data);
 521
 522         g_hash_table_destroy(hash);
 523
 524         return ior;
 525 }
 526
 527
 528 static xmlNode *options_module_captive_to_xml
 529                 (xmlNode *dest_xml_parent,const struct captive_options_module *src_options_module_captive)
 530 {
 531         g_return_val_if_fail(dest_xml_parent!=NULL,NULL);
 532         g_return_val_if_fail(src_options_module_captive!=NULL,NULL);
 533
 534         { xmlNode *module=xmlNewTextChild(dest_xml_parent,NULL,"module",NULL);
 535         const gchar *type_string="???"; /* Prevent: ... might be used uninitialized in this function */
 536         const gchar *basename,*cgs;
 537
 538                 basename=src_options_module_captive->pathname_utf8;
 539                 if ((cgs=strrchr(basename,'/')))
 540                         basename=cgs+1;
 541                 xmlNewProp(module,"basename",basename);
 542                 switch (src_options_module_captive->type) {
 543                         case CAPTIVE_OPTIONS_MODULE_TYPE_PE32:
 544                                 type_string="PE32";
 545                                 xmlNewProp(module,"length",captive_printf_alloca("%lu",(unsigned long)src_options_module_captive->u.pe32.length));
 546                                 xmlNewProp(module,"md5"   ,src_options_module_captive->u.pe32.md5);
 547                                 break;
 548                         case CAPTIVE_OPTIONS_MODULE_TYPE_GMODULE:
 549                                 type_string="gmodule";
 550                                 break;
 551                         default: g_assert_not_reached();
 552                         }
 553                 xmlNewProp(module,"type",type_string);  /* AFTER the 'switch' to set 'type_string'! */
 554                 return module;
 555                 }
 556 }
 557
 558
 559 static void sandbox_parent_bug_doc_make(CaptiveVfsParentObject *captive_vfs_parent_object)
 560 {
 561         { xmlDoc *doc=xmlNewDoc("1.0");
 562                 captive_vfs_parent_object->corba_bug_doc=doc;
 563                 { xmlNode *bug=xmlNewDocNode(captive_vfs_parent_object->corba_bug_doc,NULL,"bug",NULL);
 564                         xmlDocSetRootElement(captive_vfs_parent_object->corba_bug_doc,bug);
 565                         captive_vfs_parent_object->corba_bug=bug;
 566                         { xmlNode *bug_captive=xmlNewTextChild(bug,NULL,"captive",NULL);
 567                                 xmlNewProp(bug_captive,"version",VERSION);
 568                                 }
 569                         { xmlNode *bug_filesystem=xmlNewTextChild(bug,NULL,"filesystem",NULL);
 570                                 options_module_captive_to_xml(bug_filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
 571                                 }
 572                         { xmlNode *bug_load_module=xmlNewTextChild(bug,NULL,"load_module",NULL);
 573                         guint load_moduleui;
 574                         struct captive_options_module *options_module;
 575                         GList *load_module_node;
 576
 577                                 for (load_moduleui=0,load_module_node=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module;
 578                                                 load_module_node;
 579                                                 load_moduleui++,load_module_node=load_module_node->next) {
 580                                         options_module=load_module_node->data;
 581                                         options_module_captive_to_xml(bug_load_module,options_module);
 582                                         }
 583                                 }
 584                         { xmlNode *bug_action=xmlNewTextChild(bug,NULL,"action",NULL);
 585                                 captive_vfs_parent_object->corba_bug_action=bug_action;
 586                                 }
 587                         { xmlNode *bug_log=xmlNewTextChild(bug,NULL,"log",NULL);
 588                                 captive_vfs_parent_object->corba_bug_log=bug_log;
 589                                 }
 590                         }
 591                 }
 592 }
 593
 594
 595 static void sandbox_parent(const gchar *Vfs_IOR,const gchar *child_chroot_pid_hashkey_dir,CaptiveVfsParentObject *captive_vfs_parent_object)
 596 {
 597 Captive_Vfs Vfs_object;
 598 Captive_GLogFunc GLogFunc_object;
 599 Captive_CaptiveIOChannel CaptiveIOChannel_object;
 600 Captive_CaptiveOptions options_corba;
 601 guint load_module_length,load_moduleui;
 602 struct captive_options_module *options_module;
 603 GList *load_module_node;
 604 const gchar *child_chroot_parent_own_orbit_socket,*child_chroot_parent_own_orbit_dir;
 605 int errint;
 606
 607         g_return_if_fail(Vfs_IOR!=NULL);
 608         /* 'child_chroot_pid_hashkey_dir' may be NULL */
 609         g_return_if_fail(CAPTIVE_VFS_PARENT_IS_OBJECT(captive_vfs_parent_object));
 610
 611         Vfs_object=CORBA_ORB_string_to_object(captive_corba_orb,Vfs_IOR,&captive_corba_ev);
 612         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 613
 614         /* Init 'GLogFunc_object' */
 615         GLogFunc_object=impl_Captive_GLogFunc__create(captive_corba_poa,captive_vfs_parent_object,&captive_corba_ev);
 616         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 617
 618         /* Init 'CaptiveIOChannel_object' */
 619         if (!captive_vfs_parent_object->corba_parent_giochanel_blind_source)
 620                 switch (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode) {
 621                         case CAPTIVE_OPTION_RWMODE_RO:
 622                         case CAPTIVE_OPTION_RWMODE_RW:
 623                                 captive_vfs_parent_object->corba_parent_giochanel_blind_source=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.image_iochannel;
 624                                 break;
 625                         case CAPTIVE_OPTION_RWMODE_BLIND:
 626                                 captive_vfs_parent_object->corba_parent_giochanel_blind_source=(GIOChannel *)captive_giochannel_blind_new(
 627                                                 CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.image_iochannel, /* giochannel_orig */
 628                                                 TRUE); /* writeable */
 629                                 break;
 630                         default: g_assert_not_reached();
 631                         }
 632         if (!captive_vfs_parent_object->corba_parent_giochanel_blind)
 633                 captive_vfs_parent_object->corba_parent_giochanel_blind=(GIOChannel *)captive_giochannel_blind_new(
 634                                 captive_vfs_parent_object->corba_parent_giochanel_blind_source,  /* giochannel_orig */
 635                                 (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode!=CAPTIVE_OPTION_RWMODE_RO)); /* writeable */
 636         CaptiveIOChannel_object=impl_Captive_CaptiveIOChannel__create(captive_corba_poa,
 637                         captive_vfs_parent_object->corba_parent_giochanel_blind,&captive_corba_ev);
 638         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 639
 640         /* Create the socket needed for 'sandbox_parent_own_orbit_socket' below
 641          * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
 642          */
 643         {
 644 char *GLogFunc_IOR;
 645                 GLogFunc_IOR=CORBA_ORB_object_to_string(captive_corba_orb,GLogFunc_object,&captive_corba_ev);
 646                 g_assert(validate_CORBA_Environment(&captive_corba_ev));
 647                 g_assert(GLogFunc_IOR!=NULL);
 648                 CORBA_free(GLogFunc_IOR);
 649                 }
 650
 651         if (sandbox_parent_own_orbit_dir && !sandbox_parent_own_orbit_socket) {
 652 DIR *dir;
 653 struct dirent *dirent;
 654
 655                 dir=opendir(sandbox_parent_own_orbit_dir);
 656                 g_assert(dir!=NULL);
 657
 658                 while (errno=0,(dirent=readdir(dir))) {
 659                         if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
 660                                 continue;
 661                         g_assert(sandbox_parent_own_orbit_socket==NULL);
 662                         sandbox_parent_own_orbit_socket=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
 663                         }
 664                 g_assert(errno==0);
 665                 errint=closedir(dir);
 666                 g_assert(errint==0);
 667                 g_assert(sandbox_parent_own_orbit_socket!=NULL);
 668                 }
 669
 670         if (child_chroot_pid_hashkey_dir) {
 671 gchar *s;
 672
 673                 child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
 674                 s=(/* de-const */ gchar *)child_chroot_parent_own_orbit_dir;
 675                 do {
 676                         s=strchr(s,'/');
 677                         if (s)
 678                                 *s=0;
 679                         if (*child_chroot_parent_own_orbit_dir) {
 680                                 errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
 681                                 if (errint)
 682                                         g_assert(errno==EEXIST);
 683                                 else {
 684                                         /* chmod(2) it to prevent mode limitation by
 685                                          * active ulimit(2) of being executed by mount(8).
 686                                          */
 687                                         errint=chmod(child_chroot_parent_own_orbit_dir,0777);
 688                                         g_assert(errint==0);
 689                                         }
 690                                 }
 691                         if (s)
 692                                 *s++='/';
 693                         } while (s);
 694                 child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
 695                                 child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
 696                 errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
 697                 g_assert(errint==0);
 698                 /* chmod(2)s also our orig. one (!) but this one is protected by its 0777 directory. */
 699                 errint=chmod(child_chroot_parent_own_orbit_socket,0666);
 700                 g_assert(errint==0);
 701                 }
 702
 703         options_corba.g_log_func=GLogFunc_object;
 704         options_module_captive_to_options_module_corba(&options_corba.filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
 705         /* Prevent secondary captive_giochannel_blind inside of our sandbox child
 706          * as we already have one captive_giochannel_blind in the parent.
 707          */
 708         options_corba.rwmode        =(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode == CAPTIVE_OPTION_RWMODE_BLIND ? CAPTIVE_OPTION_RWMODE_RW
 709                         : CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode);
 710         options_corba.media         =CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.media;
 711         options_corba.debug_messages=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.debug_messages;
 712         options_corba.image_iochannel=CaptiveIOChannel_object;
 713
 714         load_module_length=g_list_length(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module);
 715         captive_newn(options_corba.load_module._buffer,load_module_length);
 716         options_corba.load_module._maximum=load_module_length;
 717         options_corba.load_module._length=load_module_length;
 718         options_corba.load_module._release=TRUE;
 719         for (load_moduleui=0,load_module_node=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module;
 720                         load_module_node;
 721                         load_moduleui++,load_module_node=load_module_node->next) {
 722                 options_module=load_module_node->data;
 723                 options_module_captive_to_options_module_corba(options_corba.load_module._buffer+load_moduleui,options_module);
 724                 }
 725
 726         Captive_Vfs_init(Vfs_object,&options_corba,&captive_corba_ev);
 727         g_assert(validate_CORBA_Environment(&captive_corba_ev));
 728
 729         /* FIXME: Free 'options_corba' - LEAK */
 730
 731         captive_vfs_parent_object->corba_Vfs_object=Vfs_object;
 732         captive_vfs_parent_object->corba_GLogFunc_object=GLogFunc_object;
 733         captive_vfs_parent_object->corba_CaptiveIOChannel_object=CaptiveIOChannel_object;
 734
 735         if (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.bug_pathname)
 736                 sandbox_parent_bug_doc_make(captive_vfs_parent_object);
 737 }
 738
 739 static void fd_shiftup(int *fdp)
 740 {
 741         g_return_if_fail(fdp!=NULL);
 742
 743         while (*fdp<=2 /* STDERR */) {
 744                 *fdp=dup(*fdp);
 745                 g_assert(*fdp!=-1);
 746                 }
 747 }
 748
 749 void captive_sandbox_fd_closeup(int fd_first_to_delete)
 750 {
 751 DIR *dir;
 752 int errint;
 753 int dir_fd;
 754 struct dirent *dirent;
 755
 756         dir=opendir("/proc/self/fd/");
 757         g_return_if_fail(dir!=NULL);
 758         dir_fd=dirfd(dir);
 759         g_return_if_fail(dir_fd!=-1);
 760
 761         while (errno=0,(dirent=readdir(dir))) {
 762 long dirent_fd;
 763 char *endptr;
 764
 765                 if (0
 766                                 || !strcmp(dirent->d_name,".")
 767                                 || !strcmp(dirent->d_name,".."))
 768                         continue;
 769                 dirent_fd=strtol(dirent->d_name,&endptr,10 /* base */);
 770                 g_assert(dirent_fd>=0 && (!endptr || !*endptr));
 771                 if (dirent_fd<fd_first_to_delete || dirent_fd==dir_fd)
 772                         continue;
 773
 774                 errint=close(dirent_fd);
 775                 g_assert(errint==0);
 776                 errno=0;
 777                 errint=close(dirent_fd);
 778                 g_assert(errint==-1); g_assert(errno==EBADF);
 779                 }
 780         g_return_if_fail(errno==0);     /* check for EOF */
 781
 782         errint=closedir(dir);
 783         g_return_if_fail(errint==0);
 784         errno=0;
 785         close(dir_fd); g_assert(errno==EBADF);  /* just a bit of paranoia; it should be already closed by closedir() */
 786 }
 787
 788 gboolean captive_sandbox_spawn(CaptiveVfsParentObject *captive_vfs_parent_object)
 789 {
 790 /* Vfs_IOR_fds[0] for reading by sandbox_parent() - client,
 791  * Vfs_IOR_fds[1] for writing by sandbox_child()  - server
 792  */
 793 int Vfs_IOR_fds[2],parentheart_fds[2];
 794 int errint;
 795 gboolean errbool;
 796
 797         g_return_val_if_fail(CAPTIVE_VFS_PARENT_IS_OBJECT(captive_vfs_parent_object),FALSE);
 798
 799         errint=pipe(Vfs_IOR_fds);
 800         g_return_val_if_fail(errint==0,FALSE);
 801         errint=pipe(parentheart_fds);
 802         g_return_val_if_fail(errint==0,FALSE);
 803
 804         /* Currently never called anywhere:
 805          *     errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 806          *     g_assert(errbool==TRUE);
 807          */
 808
 809         if (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior) {
 810                 g_assert(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv==NULL);
 811
 812                 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
 813                 g_assert(errbool==TRUE);
 814
 815                 captive_vfs_parent_object->corba_parentheart_fds_1=-1;
 816                 captive_vfs_parent_object->corba_child_pid=-1;
 817                 sandbox_parent(
 818                                 CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior,      /* Vfs_IOR */
 819                                 NULL,   /* child_chroot_pid_hashkey_dir */
 820                                 captive_vfs_parent_object);     /* captive_vfs_parent_object */
 821                 return TRUE;
 822                 }
 823
 824         g_assert(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv!=NULL);
 825         switch ((captive_vfs_parent_object->corba_child_pid=fork())) {
 826                 case -1:        /* error */
 827                         g_return_val_if_reached(FALSE);
 828
 829                 case 0: { /* child */
 830
 831                         errint=close(Vfs_IOR_fds[0]);   /* close Vfs_IOR_fd_read */
 832                         g_return_val_if_fail(errint==0,FALSE);
 833                         errint=close(parentheart_fds[1]);       /* close parentheart_fd_write */
 834                         g_return_val_if_fail(errint==0,FALSE);
 835
 836                         fd_shiftup(Vfs_IOR_fds+1);      /* Vfs_IOR_fd_write */
 837                         fd_shiftup(parentheart_fds+0);  /* parentheart_fd_read */
 838                         errint=dup2(Vfs_IOR_fds[1],1 /* STDOUT */);     /* Vfs_IOR_fd_write */
 839                         g_return_val_if_fail(errint==1 /* STDOUT */,FALSE);
 840                         errint=dup2(parentheart_fds[0],0 /* STDIN */);  /* parentheart_fd_read */
 841                         g_return_val_if_fail(errint==0 /* STDIN */,FALSE);
 842
 843                         captive_sandbox_fd_closeup(2 /* STDERR */ +1);
 844
 845                         execv(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0],
 846                                         /* re-const */ (char * const *)CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv);
 847                         g_return_val_if_reached(FALSE);
 848                         } /* NOTREACHED */
 849
 850                 default: {      /* parent */
 851 gchar *Vfs_IOR;
 852 gchar *child_chroot_pid_hashkey_dir;
 853
 854                         errint=close(Vfs_IOR_fds[1]);   /* close Vfs_IOR_fd_write */
 855                         g_return_val_if_fail(errint==0,FALSE);
 856                         errint=close(parentheart_fds[0]);       /* close parentheart_fd_read */
 857                         g_return_val_if_fail(errint==0,FALSE);
 858                         errint=fcntl(parentheart_fds[1],F_SETFD,FD_CLOEXEC);
 859                         /* This fcntl(2) may not be enough - some fork(2) may duplicate this
 860                          * write descriptor and even if we do some process finish the child
 861                          * may remain alone connected with some unknown fork(2)er from us.
 862                          * Currently I am not aware such case would occur.
 863                          */
 864                         g_return_val_if_fail(errint==0,FALSE);
 865                         captive_vfs_parent_object->corba_parentheart_fds_1=parentheart_fds[1];
 866
 867                         Vfs_IOR=sandbox_parent_read_ior(
 868                                         Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
 869                                         &child_chroot_pid_hashkey_dir,
 870                                         captive_vfs_parent_object);
 871
 872                         sandbox_parent(
 873                                         Vfs_IOR,        /* Vfs_IOR */
 874                                         child_chroot_pid_hashkey_dir,   /* child_chroot_pid_hashkey_dir */
 875                                         captive_vfs_parent_object);     /* captive_vfs_parent_object */
 876
 877                         g_free(Vfs_IOR);
 878                         g_free(child_chroot_pid_hashkey_dir);
 879
 880                         /* 'parentheart_fds[1]' - parentheart_fd_write - is left open here */
 881                         return TRUE;
 882                         }
 883                 }
 884         /* NOTREACHED */
 885         g_return_val_if_reached(FALSE);
 886 }
 887
 888
 889 GnomeVFSResult captive_sandbox_parent_return_from_CORBA_Environment
 890                 (CORBA_Environment *evp,CaptiveVfsParentObject *captive_vfs_parent_object)
 891 {
 892 GnomeVFSResult r;
 893
 894         if (evp->_major==CORBA_NO_EXCEPTION)
 895                 return GNOME_VFS_OK;
 896
 897         /* If !CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv it is CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior
 898          * where we cannot do any restart anyway.
 899          */
 900         if (captive_vfs_parent_object && CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv
 901                         && (evp->_major==CORBA_SYSTEM_EXCEPTION && !strcmp(ex_CORBA_COMM_FAILURE,CORBA_exception_id(evp)))) {
 902                 r=GNOME_VFS_ERROR_SERVICE_NOT_AVAILABLE;
 903                 if (captive_vfs_parent_object->corba_Vfs_object!=CORBA_OBJECT_NIL)
 904                         captive_vfs_parent_object_aborted(captive_vfs_parent_object);   /* errors ignored */
 905                 }
 906         else if (evp->_major==CORBA_USER_EXCEPTION && !strcmp(ex_Captive_GnomeVFSResultException,CORBA_exception_id(evp))) {
 907                 r=((Captive_GnomeVFSResultException *)CORBA_exception_value(evp))->gnome_vfs_result;
 908                 g_assert(r!=GNOME_VFS_ERROR_SERVICE_NOT_AVAILABLE);     /* code reserved for sandbox restarts */
 909                 }
 910         else {
 911                 r=GNOME_VFS_ERROR_GENERIC;
 912                 g_warning(_("CORBA Exception occured: id=\"%s\", value=%p"),
 913                                 CORBA_exception_id(evp),CORBA_exception_value(evp));
 914                 }
 915         CORBA_exception_free(evp);
 916
 917         return r;
 918 }
 919
 920
 921 void captive_sandbox_child_GnomeVFSResultException_throw(CORBA_Environment *evp,GnomeVFSResult errvfsresult)
 922 {
 923 Captive_GnomeVFSResultException *gnome_vfs_result_exception;
 924
 925         g_return_if_fail(evp!=NULL);
 926
 927         gnome_vfs_result_exception=Captive_GnomeVFSResultException__alloc();
 928         gnome_vfs_result_exception->gnome_vfs_result=errvfsresult;
 929         CORBA_exception_set(evp,CORBA_USER_EXCEPTION,ex_Captive_GnomeVFSResultException,gnome_vfs_result_exception);
 930 }