Fixed ORBit chroot(2)ing permissions failure

[captive.git] / src / libcaptive / sandbox / split.c

diff --git a/src/libcaptive/sandbox/split.c b/src/libcaptive/sandbox/split.c
index c2fdd07..90fb01b 100644 (file)
--- a/src/libcaptive/sandbox/split.c
+++ b/src/libcaptive/sandbox/split.c
@@ -76,7 +76,7 @@ gchar *orb_argv[]={
        g_return_val_if_fail(poap!=NULL,FALSE);
 
        if (done)
-               return TRUE;
+               return TRUE;    /* FIXME: '*poap' is left invalid! */
 
        /* Init 'ev' */
        CORBA_exception_init(evp);
@@ -430,7 +430,8 @@ struct sandbox_parent_own_orbit_dir_cleanup_signal *sigstructp;
                }
 }
 
-gchar *sandbox_parent_read_ior(int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp)
+static gchar *sandbox_parent_read_ior
+               (int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp,CaptiveVfsParentObject *captive_vfs_parent_object)
 {
 gchar *data;
 gsize data_size;
@@ -485,15 +486,20 @@ const gchar *chrooted_orbit_dir;
                /* IOR contains the full pathname with the setuid username encoded. */
                chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
                g_assert(chrooted_orbit_dir!=NULL);
-               if (mkdir(chrooted_orbit_dir,S_ISVTX|0777)) {
+               captive_vfs_parent_object->corba_chrooted_orbit_dir=g_strdup(chrooted_orbit_dir);
+               /* 0700 as this directory will not be reused
+                * to commuicate with any other sandbox child.
+                */
+               if (mkdir(chrooted_orbit_dir,0700)) {
                        g_assert(errno==EEXIST);
                        }
 
                socketname=g_hash_table_lookup(hash,"socketname");
                g_assert(socketname!=NULL);
+               captive_vfs_parent_object->corba_socketname=g_strdup(socketname);
 
                socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
-               socketpathname_dest=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
+               socketpathname_dest=g_strdup_printf("%s/%s",chrooted_orbit_dir,socketname);
                errint=link(socketpathname_src,socketpathname_dest);
                g_assert(errint==0);
                }
@@ -837,7 +843,8 @@ gchar *child_chroot_pid_hashkey_dir;
 
                        Vfs_IOR=sandbox_parent_read_ior(
                                        Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
-                                       &child_chroot_pid_hashkey_dir);
+                                       &child_chroot_pid_hashkey_dir,
+                                       captive_vfs_parent_object);
 
                        sandbox_parent(
                                        Vfs_IOR,        /* Vfs_IOR */