/* $Id$
* Connection of captive-vfs interface through CORBA/ORBit
- * Copyright (C) 2002 Jan Kratochvil <project-captive@jankratochvil.net>
+ * Copyright (C) 2002
-2005 Jan Kratochvil <project-captive@jankratochvil.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
#include "captive/rtl-file.h"
#include <unistd.h>
#include <fcntl.h>
-#include <linc/linc.h> /* for linc_main_get_loop() */
#include "server-Directory.h"
#include "server-Vfs.h"
#include "../client/vfs.h"
#include <errno.h>
#include "../client/giochannel-blind.h" /* for captive_giochannel_blind_new() */
#include <signal.h>
+#include "../storage/relastblock.h" /* for captive_storage_relastblock() */
+#include <sys/file.h> /* flock() */
+
+#ifdef HAVE_ORBIT_LINK
+void link_set_tmpdir(const char *dir);
+#else
+#include <linc/linc.h> /* for linc_main_get_loop() */
+#endif
/* CONFIG: */
g_error(_("CORBA Exception occured: id=\"%s\", value=%p"),
CORBA_exception_id(evp),CORBA_exception_value(evp));
- CORBA_exception_free(evp);
- return FALSE;
+ /* NOTREACHED */
+ return FALSE; /* GCC happiness. */
}
CORBA_Environment captive_corba_ev;
CORBA_exception_init(evp);
/* Init 'orb' */
- *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-orb",evp);
+ /* libcaptive is single-threaded only, caller must lock it.
+ * If thread A spawned the sandbox while currently doing its own work
+ * and thread B calls the sandbox thread B waits on ORB_run()
+ * while the sandbox waits for the response of thread A ORB. Deadlock.
+ * "orbit-local-non-threaded-orb" requests thread unaware ORB.
+ */
+ *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-non-threaded-orb",evp);
g_return_val_if_fail(*orbp!=CORBA_OBJECT_NIL,FALSE);
g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
}
#endif
+GMainLoop *captive_corba_get_loop(void)
+{
+#ifdef HAVE_ORBIT_LINK
+static GMainLoop *link_loop;
+
+ if (!link_loop)
+ link_loop=g_main_loop_new(g_main_context_default(),TRUE);
+ return link_loop;
+#else
+ return linc_main_get_loop();
+#endif
+}
+
+GMainContext *captive_corba_get_context(void)
+{
+ return g_main_loop_get_context(captive_corba_get_loop());
+}
void sandbox_child_shutdown(void)
{
/* Do not fail by passing logging messages to the master. */
impl_Captive_Vfs_init_g_log_func_disable();
- g_main_loop_quit(linc_main_get_loop());
+ g_main_loop_quit(captive_corba_get_loop());
}
heartbeat_source_callback_orb=captive_corba_orb;
- /* linc_main_get_loop() makes sense only after corba_init() -> CORBA_ORB_init() */
+ /* captive_corba_get_context() makes sense only after corba_init() -> CORBA_ORB_init() */
errguint=g_source_attach(
captive_corba_sandbox_child_heartbeat_gsource, /* source */
- g_main_loop_get_context(linc_main_get_loop())); /* context; NULL means 'default context' */
+ captive_corba_get_context()); /* context; NULL means 'default context' */
g_assert(errguint!=0);
/* Init 'Vfs_object' */
/* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
* and therefore we should be safe with glib events handling.
*/
+#ifdef HAVE_ORBIT_LINK
+ g_main_loop_run(captive_corba_get_loop());
+#else
CORBA_ORB_run(captive_corba_orb,&captive_corba_ev);
g_assert(validate_CORBA_Environment(&captive_corba_ev));
+#endif
/* Shutdown 'Vfs' servant */
Vfs_servant=PortableServer_POA_reference_to_servant(captive_corba_poa,Vfs_object,&captive_corba_ev);
g_return_if_fail(src_options_module_captive->type==CAPTIVE_OPTIONS_MODULE_TYPE_PE32);
- dest_options_module_corba->pathname_utf8=g_strdup(src_options_module_captive->pathname_utf8);
- dest_options_module_corba->data._buffer=g_memdup(src_options_module_captive->u.pe32.base,
- src_options_module_captive->u.pe32.length);
+ dest_options_module_corba->pathname_utf8=CORBA_string_dup(src_options_module_captive->pathname_utf8);
dest_options_module_corba->data._maximum=src_options_module_captive->u.pe32.length;
dest_options_module_corba->data._length =src_options_module_captive->u.pe32.length;
+ dest_options_module_corba->data._buffer=Captive_Bytes_allocbuf(dest_options_module_corba->data._maximum);
+ memcpy(dest_options_module_corba->data._buffer,src_options_module_captive->u.pe32.base,
+ src_options_module_captive->u.pe32.length);
dest_options_module_corba->data._release=TRUE;
}
struct dirent *dirent;
int errint;
- dir=opendir(dirname);
- g_assert(dir!=NULL);
+ if (!(dir=opendir(dirname)))
+ g_error(_("Failed to check for non-recursive removal directory \"%s\": %m"),dirname);
while (errno=0,(dirent=readdir(dir))) {
gchar *pathname;
g_assert(errno==0);
errint=closedir(dir);
g_assert(errint==0);
- errint=rmdir(dirname);
- g_assert(errint==0);
+ if (rmdir(dirname))
+ g_error(_("Failed to remove (non-recursive removal) directory \"%s\": %m"),dirname);
}
static const gchar *sandbox_parent_own_orbit_dir;
static gboolean done=FALSE;
g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s; done=%d",G_STRLOC,(int)done);
+
if (done)
return;
done=TRUE;
signal(signum,sigstructp->sighandler_orig);
/* Prevent recursive fatal logging before signal restore: */
- g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: signum=%d,sighandler_orig=%p",G_STRLOC,signum,sigstructp->sighandler_orig);
+ /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: signum=%d,sighandler_orig=%p",G_STRLOC,signum,sigstructp->sighandler_orig);
+ * as it is dangerous to g_log() from sighandler.
+ */
sandbox_parent_own_orbit_dir_cleanup_atexit();
- g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: re-raising...",G_STRLOC);
+ /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: re-raising...",G_STRLOC);
+ * as it is dangerous to g_log() from sighandler.
+ */
raise(signum);
}
}
}
+static void createlockdir(const gchar *dir)
+{
+gint retries;
+
+ for (retries=0;retries<10;retries++) {
+struct stat statbuf;
+int dirfd;
+
+ if (mkdir(dir,0700)) {
+ if (errno!=EEXIST)
+ g_error(_("Failed to create chroot directory \"%s\": %m"),dir);
+ unlink_nonrecursive(dir);
+ if (mkdir(dir,0700))
+ g_error(_("Failed to create chroot directory \"%s\" after attempted unlink: %m"),dir);
+ }
+ dirfd=open(dir,O_RDONLY);
+ if (dirfd==-1) {
+ if (errno!=ENOENT)
+ g_error(_("Failed to open created chroot directory \"%s\" to lock it: %m"),dir);
+ continue;
+ }
+ /* Do not use 'LOCK_NB' here as the garbage collector should release it soon. */
+ if (flock(dirfd,LOCK_EX))
+ g_error(_("Failed to lock created chroot directory \"%s\": %m"),dir);
+ if (lstat(dir,&statbuf)) {
+ if (errno!=ENOENT)
+ g_error(_("Failed to lstat(2) created chroot directory \"%s\": %m"),dir);
+ if (close(dirfd))
+ g_error(_("Failed to close created and locked chroot directory \"%s\": %m"),dir);
+ continue;
+ }
+ /* Leave 'dirfd' open to leave it LOCK_EX-ed. */
+ break;
+ }
+}
+
static gchar *sandbox_parent_read_ior
(int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp,CaptiveVfsParentObject *captive_vfs_parent_object)
{
int errint;
gchar *s,*sd,*se;
gboolean errbool;
+const gchar *ior_read_error;
/* Initialize /tmp/orbit-$username directory for linking IOR socket. */
errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
/* FIXME: Security: Duplicate giop_tmpdir_init() here. */
if (!sandbox_parent_own_orbit_dir) {
- sandbox_parent_own_orbit_dir=g_strdup_printf("/tmp/captive-orbit-%d",getpid());
- if (mkdir(sandbox_parent_own_orbit_dir,0700)) {
- g_assert(errno==EEXIST);
- sandbox_parent_own_orbit_dir_cleanup_init();
- unlink_nonrecursive(sandbox_parent_own_orbit_dir);
- if (mkdir(sandbox_parent_own_orbit_dir,0700))
- g_assert_not_reached();
- }
+ /* FIXME: Make 'CAPTIVE_SANDBOX_CHROOT' configurable. */
+ /* Use also geteuid() marker here as could not remove the directory
+ * of some other user otherwise.
+ */
+ sandbox_parent_own_orbit_dir=g_strdup_printf("%s/tmp/captive-orbit-%d-%d",CAPTIVE_SANDBOX_CHROOT,getpid(),geteuid());
sandbox_parent_own_orbit_dir_cleanup_init();
+ createlockdir(sandbox_parent_own_orbit_dir);
+#ifdef HAVE_ORBIT_LINK
+ link_set_tmpdir(sandbox_parent_own_orbit_dir);
+#else
linc_set_tmpdir(sandbox_parent_own_orbit_dir);
+#endif
}
data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
errint=close(Vfs_IOR_fd_read);
- g_assert(errint==0);
- g_assert(data!=NULL);
- g_assert(data_size>=1);
- g_assert(data[data_size-1]=='\n');
+ ior_read_error=NULL;
+#define IOR_READ_ERROR(cond) G_STMT_START { \
+ if (!ior_read_error && !(cond)) \
+ ior_read_error=G_STRINGIFY(cond); \
+ } G_STMT_END
+ IOR_READ_ERROR(errint==0);
+ IOR_READ_ERROR(data!=NULL);
+ IOR_READ_ERROR(data_size>=1);
+ IOR_READ_ERROR(data[data_size-1]=='\n');
+ if (ior_read_error)
+ g_error(_("Error connecting to the sandbox server (failed \"%s\"). Try running by hand: %s"),
+ ior_read_error,CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0]);
+#undef IOR_READ_ERROR
hash=g_hash_table_new(g_str_hash,g_str_equal);
socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
socketpathname_dest=g_strdup_printf("%s/%s",chrooted_orbit_dir,socketname);
errint=link(socketpathname_src,socketpathname_dest);
- g_assert(errint==0);
+ if (errint)
+ g_error("link(\"%s\",\"%s\")=%d:%m",socketpathname_src,socketpathname_dest,errint);
}
if (child_chroot_pid_hashkey_dirp)
*child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
g_return_val_if_fail(dest_xml_parent!=NULL,NULL);
g_return_val_if_fail(src_options_module_captive!=NULL,NULL);
- { xmlNode *module=xmlNewTextChild(dest_xml_parent,NULL,"module",NULL);
+ { xmlNode *module=xmlNewTextChild(dest_xml_parent,NULL,BAD_CAST "module",NULL);
const gchar *type_string="???"; /* Prevent: ... might be used uninitialized in this function */
const gchar *basename,*cgs;
basename=src_options_module_captive->pathname_utf8;
if ((cgs=strrchr(basename,'/')))
basename=cgs+1;
- xmlNewProp(module,"basename",basename);
+ xmlNewProp(module,BAD_CAST "basename",BAD_CAST basename);
switch (src_options_module_captive->type) {
case CAPTIVE_OPTIONS_MODULE_TYPE_PE32:
type_string="PE32";
- xmlNewProp(module,"length",captive_printf_alloca("%lu",(unsigned long)src_options_module_captive->u.pe32.length));
- xmlNewProp(module,"md5" ,src_options_module_captive->u.pe32.md5);
+ xmlNewProp(module,BAD_CAST "length",BAD_CAST captive_printf_alloca("%lu",(unsigned long)src_options_module_captive->u.pe32.length));
+ xmlNewProp(module,BAD_CAST "md5" ,BAD_CAST src_options_module_captive->u.pe32.md5);
break;
case CAPTIVE_OPTIONS_MODULE_TYPE_GMODULE:
type_string="gmodule";
break;
default: g_assert_not_reached();
}
- xmlNewProp(module,"type",type_string); /* AFTER the 'switch' to set 'type_string'! */
+ xmlNewProp(module,BAD_CAST "type",BAD_CAST type_string); /* AFTER the 'switch' to set 'type_string'! */
return module;
}
}
static void sandbox_parent_bug_doc_make(CaptiveVfsParentObject *captive_vfs_parent_object)
{
- { xmlDoc *doc=xmlNewDoc("1.0");
+ { xmlDoc *doc=xmlNewDoc(BAD_CAST "1.0");
captive_vfs_parent_object->corba_bug_doc=doc;
- { xmlNode *bug=xmlNewDocNode(captive_vfs_parent_object->corba_bug_doc,NULL,"bug",NULL);
+ { xmlNode *bug=xmlNewDocNode(captive_vfs_parent_object->corba_bug_doc,NULL,BAD_CAST "bug",NULL);
xmlDocSetRootElement(captive_vfs_parent_object->corba_bug_doc,bug);
captive_vfs_parent_object->corba_bug=bug;
- { xmlNode *bug_captive=xmlNewTextChild(bug,NULL,"captive",NULL);
- xmlNewProp(bug_captive,"version",VERSION);
+ { xmlNode *bug_captive=xmlNewTextChild(bug,NULL,BAD_CAST "captive",NULL);
+ xmlNewProp(bug_captive,BAD_CAST "version",BAD_CAST VERSION);
}
- { xmlNode *bug_filesystem=xmlNewTextChild(bug,NULL,"filesystem",NULL);
+ { xmlNode *bug_filesystem=xmlNewTextChild(bug,NULL,BAD_CAST "filesystem",NULL);
options_module_captive_to_xml(bug_filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
}
- { xmlNode *bug_load_module=xmlNewTextChild(bug,NULL,"load_module",NULL);
+ { xmlNode *bug_load_module=xmlNewTextChild(bug,NULL,BAD_CAST "load_module",NULL);
guint load_moduleui;
struct captive_options_module *options_module;
GList *load_module_node;
options_module_captive_to_xml(bug_load_module,options_module);
}
}
- { xmlNode *bug_action=xmlNewTextChild(bug,NULL,"action",NULL);
+ { xmlNode *bug_action=xmlNewTextChild(bug,NULL,BAD_CAST "action",NULL);
captive_vfs_parent_object->corba_bug_action=bug_action;
}
- { xmlNode *bug_log=xmlNewTextChild(bug,NULL,"log",NULL);
+ { xmlNode *bug_log=xmlNewTextChild(bug,NULL,BAD_CAST "log",NULL);
captive_vfs_parent_object->corba_bug_log=bug_log;
}
}
g_assert(validate_CORBA_Environment(&captive_corba_ev));
/* Init 'CaptiveIOChannel_object' */
- if (!captive_vfs_parent_object->corba_parent_giochanel_blind_source)
+ if (!captive_vfs_parent_object->corba_parent_giochanel_blind_source) {
+GIOChannel *giochannel;
+
+ giochannel=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.image_iochannel;
+ g_io_channel_ref(giochannel);
+
+ giochannel=captive_storage_relastblock(giochannel);
+
switch (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode) {
case CAPTIVE_OPTION_RWMODE_RO:
case CAPTIVE_OPTION_RWMODE_RW:
- captive_vfs_parent_object->corba_parent_giochanel_blind_source=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.image_iochannel;
break;
- case CAPTIVE_OPTION_RWMODE_BLIND:
- captive_vfs_parent_object->corba_parent_giochanel_blind_source=(GIOChannel *)captive_giochannel_blind_new(
- CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.image_iochannel, /* giochannel_orig */
+ case CAPTIVE_OPTION_RWMODE_BLIND: {
+GIOChannel *giochannel_orig;
+
+ giochannel_orig=giochannel;
+ giochannel=(GIOChannel *)captive_giochannel_blind_new(
+ giochannel, /* giochannel_orig */
TRUE); /* writeable */
- break;
+ g_io_channel_unref(giochannel_orig); /* reffed by captive_giochannel_blind_new() */
+ } break;
default: g_assert_not_reached();
}
+ captive_vfs_parent_object->corba_parent_giochanel_blind_source=giochannel;
+ }
+
if (!captive_vfs_parent_object->corba_parent_giochanel_blind)
captive_vfs_parent_object->corba_parent_giochanel_blind=(GIOChannel *)captive_giochannel_blind_new(
captive_vfs_parent_object->corba_parent_giochanel_blind_source, /* giochannel_orig */
}
if (child_chroot_pid_hashkey_dir) {
+gchar *s;
+
child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
- errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
- g_assert(errint==0);
- /* chmod(2) it to prevent mode limitation by
- * active ulimit(2) of being executed by mount(8).
- */
- errint=chmod(child_chroot_parent_own_orbit_dir,0777);
- g_assert(errint==0);
+ s=(/* de-const */ gchar *)child_chroot_parent_own_orbit_dir;
+ do {
+ s=strchr(s,'/');
+ if (s)
+ *s=0;
+ if (*child_chroot_parent_own_orbit_dir) {
+ errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
+ if (errint)
+ g_assert(errno==EEXIST);
+ else {
+ /* chmod(2) it to prevent mode limitation by
+ * active ulimit(2) of being executed by mount(8).
+ */
+ errint=chmod(child_chroot_parent_own_orbit_dir,0777);
+ g_assert(errint==0);
+ }
+ }
+ if (s)
+ *s++='/';
+ } while (s);
child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
g_assert(errint==0);
}
- options_corba.g_log_func=GLogFunc_object;
+ options_corba.g_log_func=CORBA_Object_duplicate(GLogFunc_object,&captive_corba_ev);
+ g_assert(validate_CORBA_Environment(&captive_corba_ev));
+
options_module_captive_to_options_module_corba(&options_corba.filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
/* Prevent secondary captive_giochannel_blind inside of our sandbox child
* as we already have one captive_giochannel_blind in the parent.
: CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode);
options_corba.media =CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.media;
options_corba.debug_messages=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.debug_messages;
- options_corba.image_iochannel=CaptiveIOChannel_object;
+
+ options_corba.image_iochannel=CORBA_Object_duplicate(CaptiveIOChannel_object,&captive_corba_ev);
+ g_assert(validate_CORBA_Environment(&captive_corba_ev));
load_module_length=g_list_length(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module);
- captive_newn(options_corba.load_module._buffer,load_module_length);
options_corba.load_module._maximum=load_module_length;
options_corba.load_module._length=load_module_length;
+ options_corba.load_module._buffer=Captive_CaptiveOptionsModuleList_allocbuf(options_corba.load_module._maximum);
options_corba.load_module._release=TRUE;
for (load_moduleui=0,load_module_node=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module;
load_module_node;
Captive_Vfs_init(Vfs_object,&options_corba,&captive_corba_ev);
g_assert(validate_CORBA_Environment(&captive_corba_ev));
- /* FIXME: Free 'options_corba' - LEAK */
+ Captive_CaptiveOptions__freekids(&options_corba,
+ NULL); /* d; unused */
captive_vfs_parent_object->corba_Vfs_object=Vfs_object;
captive_vfs_parent_object->corba_GLogFunc_object=GLogFunc_object;
g_return_val_if_reached(FALSE);
case 0: { /* child */
+const char *sandbox_argv0;
+int execv_rc;
errint=close(Vfs_IOR_fds[0]); /* close Vfs_IOR_fd_read */
g_return_val_if_fail(errint==0,FALSE);
captive_sandbox_fd_closeup(2 /* STDERR */ +1);
- execv(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0],
+ sandbox_argv0=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0];
+ execv_rc=execv(sandbox_argv0,
/* re-const */ (char * const *)CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv);
- g_return_val_if_reached(FALSE);
+ g_error(_("Failed to spawn sandbox server - execv(\"%s\",...)=%d: %m"),sandbox_argv0,execv_rc);
} /* NOTREACHED */
default: { /* parent */
git://git.jankratochvil.net / captive.git / blobdiff