NULL, /* finalize */
};
-void captive_corba_sandbox_child(void)
+void captive_corba_sandbox_child(const gchar *chrooted_orbit_dir)
{
Captive_Vfs Vfs_object;
impl_POA_Captive_Vfs *Vfs_servant;
gboolean errbool;
-int errint;
guint errguint;
GSource *gsource;
+int errint;
/* attach heartbeat_source_callback() to watch for any abnormalities
* on our open pipe 'parentheart_fds' and terminate the child if parent dies.
Vfs_object=impl_Captive_Vfs__create(captive_corba_poa,&captive_corba_ev);
g_assert(validate_CORBA_Environment(&captive_corba_ev));
- /* pass IOR to our parent */
+ /* Pass IOR to our parent.
+ * It will also create the socket needed for 'chrooted_orbit_dir' below
+ * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
+ */
{
char *Vfs_IOR;
Vfs_IOR=CORBA_ORB_object_to_string(captive_corba_orb,Vfs_object,&captive_corba_ev);
g_assert(validate_CORBA_Environment(&captive_corba_ev));
g_assert(Vfs_IOR!=NULL);
- errint=write(1 /* STDOUT */,Vfs_IOR,strlen(Vfs_IOR)+1);
- g_assert((unsigned)errint==strlen(Vfs_IOR)+1);
- errint=close(1 /* STDOUT */);
- g_assert(errint==0);
+ errint=printf("ior=%s\n",Vfs_IOR);
+ g_assert(errint>=0);
CORBA_free(Vfs_IOR);
}
+ /* Default mode is 0700, permit parent non-"captive" users to access our IOR socket. */
+ if (chrooted_orbit_dir) {
+DIR *dir;
+struct dirent *dirent;
+const gchar *socketname=NULL,*socketpathname;
+
+ errint=chmod(chrooted_orbit_dir,0755);
+ g_assert(errint==0);
+
+ dir=opendir(chrooted_orbit_dir);
+ g_assert(dir!=NULL);
+ while (errno=0,(dirent=readdir(dir))) {
+ if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
+ continue;
+ g_assert(socketname==NULL);
+ socketname=captive_strdup_alloca(dirent->d_name);
+ }
+ g_assert(errno==0);
+ errint=closedir(dir);
+ g_assert(errint==0);
+ g_assert(socketname!=NULL);
+
+ socketpathname=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
+ errint=chmod(socketpathname,0666);
+ g_assert(errint==0);
+
+ printf("socketname=%s\n",socketname);
+ }
+
+ /* Close the output to flush it to our spawning parent. */
+ errint=fflush(stdout);
+ g_assert(errint==0);
+ errint=fclose(stdout);
+ g_assert(errint==0);
+
/* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
* and therefore we should be safe with glib events handling.
*/
}
-static void sandbox_parent(const char *Vfs_IOR,struct captive_options *options_captive,Captive_Vfs *corba_Vfs_object_return,
+static const gchar *sandbox_parent_own_orbit_dir;
+static const gchar *sandbox_parent_own_orbit_socket;
+
+gchar *sandbox_parent_read_ior(int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp)
+{
+gchar *data;
+gsize data_size;
+GHashTable *hash;
+gchar *ior,*child_chroot_pid_hashkey_dir;
+int errint;
+gchar *s,*sd,*se;
+gboolean errbool;
+
+ /* Initialize /tmp/orbit-$username directory for linking IOR socket. */
+ errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
+ g_assert(errbool==TRUE);
+
+ /* FIXME: Security: Duplicate giop_tmpdir_init() here. */
+ if (!sandbox_parent_own_orbit_dir) {
+ sandbox_parent_own_orbit_dir=captive_printf_alloca("/tmp/captive-orbit-%d",getpid());
+ if (mkdir(sandbox_parent_own_orbit_dir,0700)) {
+DIR *dir;
+struct dirent *dirent;
+ g_assert(errno==EEXIST);
+
+ dir=opendir(sandbox_parent_own_orbit_dir);
+ g_assert(dir!=NULL);
+
+ while (errno=0,(dirent=readdir(dir))) {
+gchar *pathname;
+ if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
+ continue;
+ pathname=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
+ errint=unlink(pathname);
+ g_assert(errint==0);
+ g_free(pathname);
+ }
+ g_assert(errno==0);
+ errint=closedir(dir);
+ g_assert(errint==0);
+ }
+ linc_set_tmpdir(sandbox_parent_own_orbit_dir);
+ }
+
+ data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
+ errint=close(Vfs_IOR_fd_read);
+ g_assert(errint==0);
+ g_assert(data!=NULL);
+ g_assert(data_size>=1);
+ g_assert(data[data_size-1]=='\n');
+
+ hash=g_hash_table_new(g_str_hash,g_str_equal);
+
+ for (s=data;s<data+data_size;s=se+1) {
+ se=strchr(s,'\n');
+ g_assert(se!=NULL);
+ *se=0;
+ sd=strchr(s,'=');
+ g_assert(sd!=NULL);
+ *sd=0;
+ g_hash_table_insert(hash,s,sd+1);
+ }
+ g_assert(s==data+data_size);
+
+ if ((child_chroot_pid_hashkey_dir=g_hash_table_lookup(hash,"chroot_pid_hashkey_dir"))) {
+const gchar *socketname,*socketpathname_src,*socketpathname_dest;
+const gchar *chrooted_orbit_dir;
+
+ /* IOR contains the full pathname with the setuid username encoded. */
+ chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
+ g_assert(chrooted_orbit_dir!=NULL);
+ if (mkdir(chrooted_orbit_dir,S_ISVTX|0777)) {
+ g_assert(errno==EEXIST);
+ }
+
+ socketname=g_hash_table_lookup(hash,"socketname");
+ g_assert(socketname!=NULL);
+
+ socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
+ socketpathname_dest=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
+ errint=link(socketpathname_src,socketpathname_dest);
+ g_assert(errint==0);
+ }
+ if (child_chroot_pid_hashkey_dirp)
+ *child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
+
+ ior=g_hash_table_lookup(hash,"ior");
+ g_assert(ior!=NULL);
+ ior=g_strdup(ior);
+ g_free(data);
+
+ g_hash_table_destroy(hash);
+
+ return ior;
+}
+
+
+static void sandbox_parent(const gchar *Vfs_IOR,const gchar *child_chroot_pid_hashkey_dir,
+ struct captive_options *options_captive,Captive_Vfs *corba_Vfs_object_return,
Captive_GLogFunc *corba_GLogFunc_object_return,Captive_CaptiveIOChannel *corba_CaptiveIOChannel_object_return)
{
Captive_Vfs Vfs_object;
Captive_CaptiveOptions options_corba;
guint load_module_length,load_moduleui;
struct captive_options_module *options_module;
-gboolean errbool;
GList *load_module_node;
+const gchar *child_chroot_parent_own_orbit_socket,*child_chroot_parent_own_orbit_dir;
+int errint;
g_return_if_fail(Vfs_IOR!=NULL);
g_return_if_fail(corba_Vfs_object_return!=NULL);
g_return_if_fail(corba_GLogFunc_object_return!=NULL);
- errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
- g_assert(errbool==TRUE);
-
Vfs_object=CORBA_ORB_string_to_object(captive_corba_orb,Vfs_IOR,&captive_corba_ev);
g_assert(validate_CORBA_Environment(&captive_corba_ev));
options_captive->image_iochannel,&captive_corba_ev);
g_assert(validate_CORBA_Environment(&captive_corba_ev));
+ /* Create the socket needed for 'sandbox_parent_own_orbit_socket' below
+ * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
+ */
+ {
+char *GLogFunc_IOR;
+ GLogFunc_IOR=CORBA_ORB_object_to_string(captive_corba_orb,GLogFunc_object,&captive_corba_ev);
+ g_assert(validate_CORBA_Environment(&captive_corba_ev));
+ g_assert(GLogFunc_IOR!=NULL);
+ CORBA_free(GLogFunc_IOR);
+ }
+
+ if (!sandbox_parent_own_orbit_socket) {
+DIR *dir;
+struct dirent *dirent;
+
+ g_assert(sandbox_parent_own_orbit_dir!=NULL);
+
+ dir=opendir(sandbox_parent_own_orbit_dir);
+ g_assert(dir!=NULL);
+
+ while (errno=0,(dirent=readdir(dir))) {
+ if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
+ continue;
+ g_assert(sandbox_parent_own_orbit_socket==NULL);
+ sandbox_parent_own_orbit_socket=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
+ }
+ g_assert(errno==0);
+ errint=closedir(dir);
+ g_assert(errint==0);
+ g_assert(sandbox_parent_own_orbit_socket!=NULL);
+ }
+
+ child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
+ errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
+ g_assert(errint==0);
+ child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
+ child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
+ errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
+ g_assert(errint==0);
+ /* chmod(2)s also our orig. one (!) but this one is protected by its 0777 directory. */
+ errint=chmod(child_chroot_parent_own_orbit_socket,0666);
+ g_assert(errint==0);
+
options_corba.g_log_func=GLogFunc_object;
options_module_captive_to_options_module_corba(&options_corba.filesystem,&options_captive->filesystem);
options_corba.rwmode =options_captive->rwmode;
* g_assert(errbool==TRUE);
*/
- if (captive_sandbox_server_ior) {
+ if (child_captive_vfs_object->options.sandbox_server_ior) {
+ g_assert(child_captive_vfs_object->options.sandbox_server_argv==NULL);
*parentheart_fds_1_return=-1;
sandbox_parent(
- captive_sandbox_server_ior, /* Vfs_IOR */
+ child_captive_vfs_object->options.sandbox_server_ior, /* Vfs_IOR */
+ NULL, /* child_chroot_pid_hashkey_dir */
&child_captive_vfs_object->options, /* options_captive */
corba_Vfs_object_return, /* corba_Vfs_object_return */
corba_GLogFunc_object_return, /* corba_GLogFunc_object_return */
return TRUE;
}
- g_assert(captive_sandbox_server_argv!=NULL);
+ g_assert(child_captive_vfs_object->options.sandbox_server_argv!=NULL);
switch (fork()) {
case -1: /* error */
g_return_val_if_reached(FALSE);
captive_sandbox_fd_closeup(2 /* STDERR */ +1);
- execv(captive_sandbox_server_argv[0],/* re-const */ (char * const *)captive_sandbox_server_argv);
+ execv(child_captive_vfs_object->options.sandbox_server_argv[0],
+ /* re-const */ (char * const *)child_captive_vfs_object->options.sandbox_server_argv);
g_return_val_if_reached(FALSE);
} /* NOTREACHED */
default: { /* parent */
-char *Vfs_IOR;
-gsize Vfs_IOR_size;
+gchar *Vfs_IOR;
+gchar *child_chroot_pid_hashkey_dir;
errint=close(Vfs_IOR_fds[1]); /* close Vfs_IOR_fd_write */
g_return_val_if_fail(errint==0,FALSE);
g_return_val_if_fail(errint==0,FALSE);
*parentheart_fds_1_return=parentheart_fds[1];
- Vfs_IOR=captive_rtl_file_read(Vfs_IOR_fds[0],&Vfs_IOR_size); /* Vfs_IOR_fd_read */
- g_assert(Vfs_IOR!=NULL);
- g_assert(Vfs_IOR_size>=1);
- g_assert(memchr(Vfs_IOR,0,Vfs_IOR_size)==Vfs_IOR+(Vfs_IOR_size-1)); /* check exactly for 0-terminated string */
- errint=close(Vfs_IOR_fds[0]); /* Vfs_IOR_fd_read */
- g_assert(errint==0);
+ Vfs_IOR=sandbox_parent_read_ior(
+ Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
+ &child_chroot_pid_hashkey_dir);
sandbox_parent(
Vfs_IOR, /* Vfs_IOR */
+ child_chroot_pid_hashkey_dir, /* child_chroot_pid_hashkey_dir */
&child_captive_vfs_object->options, /* options_captive */
corba_Vfs_object_return, /* corba_Vfs_object_return */
corba_GLogFunc_object_return, /* corba_GLogFunc_object_return */
corba_CaptiveIOChannel_object_return); /* corba_CaptiveIOChannel_object_return */
g_free(Vfs_IOR);
+ g_free(child_chroot_pid_hashkey_dir);
/* 'parentheart_fds[1]' - parentheart_fd_write - is left open here */
return TRUE;
g_return_val_if_fail(evp!=NULL,FALSE);
g_return_val_if_fail(captive_vfs_object!=NULL,FALSE);
- /* If !captive_sandbox_server_argv it is captive_sandbox_server_ior
+ /* If !child_captive_vfs_object->options.sandbox_server_argv it is child_captive_vfs_object->options.sandbox_server_ior
* where we cannot do any restart anyway.
*/
- if (!captive_sandbox_server_argv
+ if (!captive_vfs_object->options.sandbox_server_argv
|| !(evp->_major==CORBA_SYSTEM_EXCEPTION && !strcmp(ex_CORBA_COMM_FAILURE,CORBA_exception_id(evp))))
return FALSE; /* no retry */
CORBA_exception_free(evp);
git://git.jankratochvil.net / captive.git / commitdiff