2 * Connection of captive-vfs interface through CORBA/ORBit
3 * Copyright (C) 2002-2005 Jan Kratochvil <project-captive@jankratochvil.net>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; exactly version 2 of June 1991 is required
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include "split.h" /* self */
24 #include "server-GLogFunc.h"
25 #include "captive/macros.h"
26 #include <glib/gmacros.h>
28 #include "captive/rtl-file.h"
31 #include "server-Directory.h"
32 #include "server-Vfs.h"
33 #include "../client/vfs.h"
34 #include "parent-Vfs.h"
36 #include "server-CaptiveIOChannel.h"
38 #include "../client/giochannel-blind.h" /* for captive_giochannel_blind_new() */
40 #include "../storage/relastblock.h" /* for captive_storage_relastblock() */
41 #include <sys/file.h> /* flock() */
43 #ifdef HAVE_ORBIT_LINK
44 void link_set_tmpdir(const char *dir);
46 #include <linc/linc.h> /* for linc_main_get_loop() */
52 #define HEARTBEAT_SOURCE_CHECK_EVENTS (G_IO_IN|G_IO_PRI)
53 #define HEARTBEAT_SOURCE_CHECK_REVENTS (HEARTBEAT_SOURCE_CHECK_EVENTS|G_IO_ERR|G_IO_HUP|G_IO_NVAL)
56 gboolean validate_CORBA_Environment(CORBA_Environment *evp)
58 if (evp->_major==CORBA_NO_EXCEPTION)
61 g_error(_("CORBA Exception occured: id=\"%s\", value=%p"),
62 CORBA_exception_id(evp),CORBA_exception_value(evp));
64 return FALSE; /* GCC happiness. */
67 CORBA_Environment captive_corba_ev;
68 CORBA_ORB captive_corba_orb;
69 PortableServer_POA captive_corba_poa;
71 static void corba_shutdown_atexit(void);
73 static gboolean corba_init(const char *pname,CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
75 static gboolean done=FALSE;
78 (gchar *)captive_strdup_alloca(pname),
81 g_return_val_if_fail(evp!=NULL,FALSE);
82 g_return_val_if_fail(orbp!=NULL,FALSE);
83 g_return_val_if_fail(poap!=NULL,FALSE);
86 return TRUE; /* FIXME: '*poap' is left invalid! */
89 CORBA_exception_init(evp);
92 /* libcaptive is single-threaded only, caller must lock it.
93 * If thread A spawned the sandbox while currently doing its own work
94 * and thread B calls the sandbox thread B waits on ORB_run()
95 * while the sandbox waits for the response of thread A ORB. Deadlock.
96 * "orbit-local-non-threaded-orb" requests thread unaware ORB.
98 *orbp=CORBA_ORB_init(&orb_argc,orb_argv,"orbit-local-non-threaded-orb",evp);
99 g_return_val_if_fail(*orbp!=CORBA_OBJECT_NIL,FALSE);
100 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
103 *poap=(PortableServer_POA)CORBA_ORB_resolve_initial_references(*orbp,"RootPOA",evp);
104 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
106 PortableServer_POAManager poa_mgr;
107 poa_mgr=PortableServer_POA__get_the_POAManager(*poap,evp);
108 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
109 PortableServer_POAManager_activate(poa_mgr,evp);
110 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
111 CORBA_Object_release((CORBA_Object)poa_mgr,evp);
112 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
115 g_atexit(corba_shutdown_atexit);
122 static CORBA_ORB heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
124 gboolean corba_shutdown(CORBA_Environment *evp,CORBA_ORB *orbp,PortableServer_POA *poap)
126 PortableServer_POA poa;
129 g_return_val_if_fail(evp!=NULL,FALSE);
130 g_return_val_if_fail(orbp!=NULL,FALSE);
131 g_return_val_if_fail(poap!=NULL,FALSE);
135 *poap=CORBA_OBJECT_NIL;
136 CORBA_Object_release((CORBA_Object)poa,evp);
137 g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
141 *orbp=CORBA_OBJECT_NIL;
142 heartbeat_source_callback_orb=CORBA_OBJECT_NIL;
143 CORBA_ORB_destroy(orb,evp);
144 /* Do not: g_return_val_if_fail(validate_CORBA_Environment(evp),FALSE);
145 * here as CORBA_ORB_destroy() sometimes reports:
146 * WARNING **: ORB: a total of X refs to X ORB objects were leaked
148 CORBA_exception_free(evp);
151 CORBA_exception_free(evp);
156 static void sandbox_parent_own_orbit_dir_cleanup_atexit(void);
158 static void corba_shutdown_atexit(void)
162 errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
163 g_assert(errbool==TRUE);
165 /* Delete the CORBA ORB socket directory only after full CORBA ORB shutdown. */
166 sandbox_parent_own_orbit_dir_cleanup_atexit();
170 static GSource *captive_corba_sandbox_child_heartbeat_gsource;
172 #if 0 /* Currently unused - see server-Vfs.c:impl_Captive_Vfs_shutdown() */
173 void sandbox_child_prepare_shutdown(void)
175 /* Prevent during shutdown: Captive-WARNING **: CORBA Exception occured: id="IDL:omg.org/CORBA/COMM_FAILURE:1.0" */
176 if (captive_corba_sandbox_child_heartbeat_gsource) {
177 g_source_destroy(captive_corba_sandbox_child_heartbeat_gsource);
178 g_source_unref(captive_corba_sandbox_child_heartbeat_gsource);
179 captive_corba_sandbox_child_heartbeat_gsource=NULL;
184 GMainLoop *captive_corba_get_loop(void)
186 #ifdef HAVE_ORBIT_LINK
187 static GMainLoop *link_loop;
190 link_loop=g_main_loop_new(g_main_context_default(),TRUE);
193 return linc_main_get_loop();
197 GMainContext *captive_corba_get_context(void)
199 return g_main_loop_get_context(captive_corba_get_loop());
202 void sandbox_child_shutdown(void)
204 /* Do not fail by passing logging messages to the master. */
205 impl_Captive_Vfs_init_g_log_func_disable();
207 g_main_loop_quit(captive_corba_get_loop());
211 static gboolean heartbeat_source_callback(gpointer data /* unused */)
213 g_return_val_if_fail(heartbeat_source_callback_orb!=CORBA_OBJECT_NIL,FALSE); /* the source should be removed */
215 sandbox_child_shutdown();
217 return FALSE; /* the source should be removed */
221 static gboolean heartbeat_source_prepare(GSource *source,gint *timeout)
228 static GPollFD heartbeat_source_check_gpollfd;
230 static gboolean heartbeat_source_check(GSource *source)
232 return !!(heartbeat_source_check_gpollfd.revents & HEARTBEAT_SOURCE_CHECK_REVENTS);
235 static gboolean heartbeat_source_dispatch(GSource *source,GSourceFunc callback,gpointer user_data)
237 g_assert(callback!=NULL);
238 return (*callback)(user_data);
241 static GSourceFuncs heartbeat_source_watch_funcs={
242 heartbeat_source_prepare,
243 heartbeat_source_check,
244 heartbeat_source_dispatch,
248 void captive_corba_sandbox_child(const gchar *chrooted_orbit_dir)
250 Captive_Vfs Vfs_object;
251 impl_POA_Captive_Vfs *Vfs_servant;
256 /* attach heartbeat_source_callback() to watch for any abnormalities
257 * on our open pipe 'parentheart_fds' and terminate the child if parent dies.
259 captive_corba_sandbox_child_heartbeat_gsource=g_source_new(&heartbeat_source_watch_funcs,sizeof(GSource));
260 g_return_if_fail(captive_corba_sandbox_child_heartbeat_gsource!=NULL);
261 g_source_set_callback(
262 captive_corba_sandbox_child_heartbeat_gsource, /* source */
263 heartbeat_source_callback, /* func */
266 heartbeat_source_check_gpollfd.fd=0 /* STDIN */; /* parentheart_fd_read */
267 heartbeat_source_check_gpollfd.events=HEARTBEAT_SOURCE_CHECK_EVENTS;
268 heartbeat_source_check_gpollfd.revents=0;
269 g_source_add_poll(captive_corba_sandbox_child_heartbeat_gsource,&heartbeat_source_check_gpollfd);
271 errbool=corba_init("captive-sandbox-child",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
272 g_return_if_fail(errbool==TRUE);
274 heartbeat_source_callback_orb=captive_corba_orb;
276 /* captive_corba_get_context() makes sense only after corba_init() -> CORBA_ORB_init() */
277 errguint=g_source_attach(
278 captive_corba_sandbox_child_heartbeat_gsource, /* source */
279 captive_corba_get_context()); /* context; NULL means 'default context' */
280 g_assert(errguint!=0);
282 /* Init 'Vfs_object' */
283 Vfs_object=impl_Captive_Vfs__create(captive_corba_poa,&captive_corba_ev);
284 g_assert(validate_CORBA_Environment(&captive_corba_ev));
286 /* Pass IOR to our parent.
287 * It will also create the socket needed for 'chrooted_orbit_dir' below
288 * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
292 Vfs_IOR=CORBA_ORB_object_to_string(captive_corba_orb,Vfs_object,&captive_corba_ev);
293 g_assert(validate_CORBA_Environment(&captive_corba_ev));
294 g_assert(Vfs_IOR!=NULL);
295 errint=printf("ior=%s\n",Vfs_IOR);
300 /* Default mode is 0700, permit parent non-"captive" users to access our IOR socket. */
301 if (chrooted_orbit_dir) {
303 struct dirent *dirent;
304 const gchar *socketname=NULL,*socketpathname;
306 errint=chmod(chrooted_orbit_dir,0755);
309 dir=opendir(chrooted_orbit_dir);
311 while (errno=0,(dirent=readdir(dir))) {
312 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
314 g_assert(socketname==NULL);
315 socketname=captive_strdup_alloca(dirent->d_name);
318 errint=closedir(dir);
320 g_assert(socketname!=NULL);
322 socketpathname=captive_printf_alloca("%s/%s",chrooted_orbit_dir,socketname);
323 errint=chmod(socketpathname,0666);
326 printf("socketname=%s\n",socketname);
329 /* Close the output to flush it to our spawning parent. */
330 errint=fflush(stdout);
332 errint=fclose(stdout);
335 /* CORBA_ORB_run() -> linc_main_loop_run() -> g_main_loop_run()
336 * and therefore we should be safe with glib events handling.
338 #ifdef HAVE_ORBIT_LINK
339 g_main_loop_run(captive_corba_get_loop());
341 CORBA_ORB_run(captive_corba_orb,&captive_corba_ev);
342 g_assert(validate_CORBA_Environment(&captive_corba_ev));
345 /* Shutdown 'Vfs' servant */
346 Vfs_servant=PortableServer_POA_reference_to_servant(captive_corba_poa,Vfs_object,&captive_corba_ev);
347 g_assert(validate_CORBA_Environment(&captive_corba_ev));
348 CORBA_Object_release(Vfs_object,&captive_corba_ev);
349 g_assert(validate_CORBA_Environment(&captive_corba_ev));
350 impl_Captive_Vfs__destroy(Vfs_servant,&captive_corba_ev);
351 g_assert(validate_CORBA_Environment(&captive_corba_ev));
353 errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
354 g_assert(errbool==TRUE);
360 static void options_module_captive_to_options_module_corba
361 (Captive_CaptiveOptionsModule *dest_options_module_corba,const struct captive_options_module *src_options_module_captive)
363 g_return_if_fail(dest_options_module_corba!=NULL);
364 g_return_if_fail(src_options_module_captive!=NULL);
366 g_return_if_fail(src_options_module_captive->type==CAPTIVE_OPTIONS_MODULE_TYPE_PE32);
368 dest_options_module_corba->pathname_utf8=CORBA_string_dup(src_options_module_captive->pathname_utf8);
369 dest_options_module_corba->data._maximum=src_options_module_captive->u.pe32.length;
370 dest_options_module_corba->data._length =src_options_module_captive->u.pe32.length;
371 dest_options_module_corba->data._buffer=Captive_Bytes_allocbuf(dest_options_module_corba->data._maximum);
372 memcpy(dest_options_module_corba->data._buffer,src_options_module_captive->u.pe32.base,
373 src_options_module_captive->u.pe32.length);
374 dest_options_module_corba->data._release=TRUE;
377 static void unlink_nonrecursive(const gchar *dirname)
380 struct dirent *dirent;
383 if (!(dir=opendir(dirname)))
384 g_error(_("Failed to check for non-recursive removal directory \"%s\": %m"),dirname);
386 while (errno=0,(dirent=readdir(dir))) {
389 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
391 pathname=g_strdup_printf("%s/%s",dirname,dirent->d_name);
392 errint=unlink(pathname);
397 errint=closedir(dir);
400 g_error(_("Failed to remove (non-recursive removal) directory \"%s\": %m"),dirname);
403 static const gchar *sandbox_parent_own_orbit_dir;
404 static const gchar *sandbox_parent_own_orbit_socket;
406 static void sandbox_parent_own_orbit_dir_cleanup_atexit(void)
408 static gboolean done=FALSE;
410 g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s; done=%d",G_STRLOC,(int)done);
416 if (sandbox_parent_own_orbit_dir)
417 unlink_nonrecursive(sandbox_parent_own_orbit_dir);
420 static struct sandbox_parent_own_orbit_dir_cleanup_signal {
422 /* FIXME: Why we cannot use 'sighandler_t'? */ void (*sighandler_orig)(int signum);
423 } sandbox_parent_own_orbit_dir_cleanup_signals[]={
432 static void sandbox_parent_own_orbit_dir_cleanup_sighandler(int signum)
434 struct sandbox_parent_own_orbit_dir_cleanup_signal *sigstructp;
437 sigstructp=sandbox_parent_own_orbit_dir_cleanup_signals;
438 sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals);
440 if (sigstructp->signum==signum)
443 g_assert(sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals));
444 signal(signum,sigstructp->sighandler_orig);
446 /* Prevent recursive fatal logging before signal restore: */
447 /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: signum=%d,sighandler_orig=%p",G_STRLOC,signum,sigstructp->sighandler_orig);
448 * as it is dangerous to g_log() from sighandler.
451 sandbox_parent_own_orbit_dir_cleanup_atexit();
453 /* Do not: g_log(G_LOG_DOMAIN,G_LOG_LEVEL_DEBUG,"%s: re-raising...",G_STRLOC);
454 * as it is dangerous to g_log() from sighandler.
459 static void sandbox_parent_own_orbit_dir_cleanup_init(void)
461 struct sandbox_parent_own_orbit_dir_cleanup_signal *sigstructp;
464 sigstructp=sandbox_parent_own_orbit_dir_cleanup_signals;
465 sigstructp<sandbox_parent_own_orbit_dir_cleanup_signals+G_N_ELEMENTS(sandbox_parent_own_orbit_dir_cleanup_signals);
467 sigstructp->sighandler_orig=signal(sigstructp->signum,sandbox_parent_own_orbit_dir_cleanup_sighandler);
468 if (sigstructp->sighandler_orig==SIG_IGN)
469 sigstructp->sighandler_orig=SIG_DFL;
473 static void createlockdir(const gchar *dir)
477 for (retries=0;retries<10;retries++) {
481 if (mkdir(dir,0700)) {
483 g_error(_("Failed to create chroot directory \"%s\": %m"),dir);
484 unlink_nonrecursive(dir);
486 g_error(_("Failed to create chroot directory \"%s\" after attempted unlink: %m"),dir);
488 dirfd=open(dir,O_RDONLY);
491 g_error(_("Failed to open created chroot directory \"%s\" to lock it: %m"),dir);
494 /* Do not use 'LOCK_NB' here as the garbage collector should release it soon. */
495 if (flock(dirfd,LOCK_EX))
496 g_error(_("Failed to lock created chroot directory \"%s\": %m"),dir);
497 if (lstat(dir,&statbuf)) {
499 g_error(_("Failed to lstat(2) created chroot directory \"%s\": %m"),dir);
501 g_error(_("Failed to close created and locked chroot directory \"%s\": %m"),dir);
504 /* Leave 'dirfd' open to leave it LOCK_EX-ed. */
509 static gchar *sandbox_parent_read_ior
510 (int Vfs_IOR_fd_read,gchar **child_chroot_pid_hashkey_dirp,CaptiveVfsParentObject *captive_vfs_parent_object)
515 gchar *ior,*child_chroot_pid_hashkey_dir;
519 const gchar *ior_read_error;
521 /* Initialize /tmp/orbit-$username directory for linking IOR socket. */
522 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
523 g_assert(errbool==TRUE);
525 /* FIXME: Security: Duplicate giop_tmpdir_init() here. */
526 if (!sandbox_parent_own_orbit_dir) {
527 /* FIXME: Make 'CAPTIVE_SANDBOX_CHROOT' configurable. */
528 /* Use also geteuid() marker here as could not remove the directory
529 * of some other user otherwise.
531 sandbox_parent_own_orbit_dir=g_strdup_printf("%s/tmp/captive-orbit-%d-%d",CAPTIVE_SANDBOX_CHROOT,getpid(),geteuid());
532 sandbox_parent_own_orbit_dir_cleanup_init();
533 createlockdir(sandbox_parent_own_orbit_dir);
534 #ifdef HAVE_ORBIT_LINK
535 link_set_tmpdir(sandbox_parent_own_orbit_dir);
537 linc_set_tmpdir(sandbox_parent_own_orbit_dir);
541 data=captive_rtl_file_read(Vfs_IOR_fd_read,&data_size); /* data_fd_read */
542 errint=close(Vfs_IOR_fd_read);
544 #define IOR_READ_ERROR(cond) G_STMT_START { \
545 if (!ior_read_error && !(cond)) \
546 ior_read_error=G_STRINGIFY(cond); \
548 IOR_READ_ERROR(errint==0);
549 IOR_READ_ERROR(data!=NULL);
550 IOR_READ_ERROR(data_size>=1);
551 IOR_READ_ERROR(data[data_size-1]=='\n');
553 g_error(_("Error connecting to the sandbox server (failed \"%s\"). Try running by hand: %s"),
554 ior_read_error,CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0]);
555 #undef IOR_READ_ERROR
557 hash=g_hash_table_new(g_str_hash,g_str_equal);
559 for (s=data;s<data+data_size;s=se+1) {
566 g_hash_table_insert(hash,s,sd+1);
568 g_assert(s==data+data_size);
570 if ((child_chroot_pid_hashkey_dir=g_hash_table_lookup(hash,"chroot_pid_hashkey_dir"))) {
571 const gchar *socketname,*socketpathname_src,*socketpathname_dest;
572 const gchar *chrooted_orbit_dir;
574 /* IOR contains the full pathname with the setuid username encoded. */
575 chrooted_orbit_dir=g_hash_table_lookup(hash,"chrooted_orbit_dir");
576 g_assert(chrooted_orbit_dir!=NULL);
577 captive_vfs_parent_object->corba_chrooted_orbit_dir=g_strdup(chrooted_orbit_dir);
578 /* 0700 as this directory will not be reused
579 * to commuicate with any other sandbox child.
581 if (mkdir(chrooted_orbit_dir,0700)) {
582 g_assert(errno==EEXIST);
585 socketname=g_hash_table_lookup(hash,"socketname");
586 g_assert(socketname!=NULL);
587 captive_vfs_parent_object->corba_socketname=g_strdup(socketname);
589 socketpathname_src=captive_printf_alloca("%s/%s/%s",child_chroot_pid_hashkey_dir,chrooted_orbit_dir,socketname);
590 socketpathname_dest=g_strdup_printf("%s/%s",chrooted_orbit_dir,socketname);
591 errint=link(socketpathname_src,socketpathname_dest);
593 g_error("link(\"%s\",\"%s\")=%d:%m",socketpathname_src,socketpathname_dest,errint);
595 if (child_chroot_pid_hashkey_dirp)
596 *child_chroot_pid_hashkey_dirp=g_strdup(child_chroot_pid_hashkey_dir);
598 ior=g_hash_table_lookup(hash,"ior");
603 g_hash_table_destroy(hash);
609 static xmlNode *options_module_captive_to_xml
610 (xmlNode *dest_xml_parent,const struct captive_options_module *src_options_module_captive)
612 g_return_val_if_fail(dest_xml_parent!=NULL,NULL);
613 g_return_val_if_fail(src_options_module_captive!=NULL,NULL);
615 { xmlNode *module=xmlNewTextChild(dest_xml_parent,NULL,BAD_CAST "module",NULL);
616 const gchar *type_string="???"; /* Prevent: ... might be used uninitialized in this function */
617 const gchar *basename,*cgs;
619 basename=src_options_module_captive->pathname_utf8;
620 if ((cgs=strrchr(basename,'/')))
622 xmlNewProp(module,BAD_CAST "basename",BAD_CAST basename);
623 switch (src_options_module_captive->type) {
624 case CAPTIVE_OPTIONS_MODULE_TYPE_PE32:
626 xmlNewProp(module,BAD_CAST "length",BAD_CAST captive_printf_alloca("%lu",(unsigned long)src_options_module_captive->u.pe32.length));
627 xmlNewProp(module,BAD_CAST "md5" ,BAD_CAST src_options_module_captive->u.pe32.md5);
629 case CAPTIVE_OPTIONS_MODULE_TYPE_GMODULE:
630 type_string="gmodule";
632 default: g_assert_not_reached();
634 xmlNewProp(module,BAD_CAST "type",BAD_CAST type_string); /* AFTER the 'switch' to set 'type_string'! */
640 static void sandbox_parent_bug_doc_make(CaptiveVfsParentObject *captive_vfs_parent_object)
642 { xmlDoc *doc=xmlNewDoc(BAD_CAST "1.0");
643 captive_vfs_parent_object->corba_bug_doc=doc;
644 { xmlNode *bug=xmlNewDocNode(captive_vfs_parent_object->corba_bug_doc,NULL,BAD_CAST "bug",NULL);
645 xmlDocSetRootElement(captive_vfs_parent_object->corba_bug_doc,bug);
646 captive_vfs_parent_object->corba_bug=bug;
647 { xmlNode *bug_captive=xmlNewTextChild(bug,NULL,BAD_CAST "captive",NULL);
648 xmlNewProp(bug_captive,BAD_CAST "version",BAD_CAST VERSION);
650 { xmlNode *bug_filesystem=xmlNewTextChild(bug,NULL,BAD_CAST "filesystem",NULL);
651 options_module_captive_to_xml(bug_filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
653 { xmlNode *bug_load_module=xmlNewTextChild(bug,NULL,BAD_CAST "load_module",NULL);
655 struct captive_options_module *options_module;
656 GList *load_module_node;
658 for (load_moduleui=0,load_module_node=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module;
660 load_moduleui++,load_module_node=load_module_node->next) {
661 options_module=load_module_node->data;
662 options_module_captive_to_xml(bug_load_module,options_module);
665 { xmlNode *bug_action=xmlNewTextChild(bug,NULL,BAD_CAST "action",NULL);
666 captive_vfs_parent_object->corba_bug_action=bug_action;
668 { xmlNode *bug_log=xmlNewTextChild(bug,NULL,BAD_CAST "log",NULL);
669 captive_vfs_parent_object->corba_bug_log=bug_log;
676 static void sandbox_parent(const gchar *Vfs_IOR,const gchar *child_chroot_pid_hashkey_dir,CaptiveVfsParentObject *captive_vfs_parent_object)
678 Captive_Vfs Vfs_object;
679 Captive_GLogFunc GLogFunc_object;
680 Captive_CaptiveIOChannel CaptiveIOChannel_object;
681 Captive_CaptiveOptions options_corba;
682 guint load_module_length,load_moduleui;
683 struct captive_options_module *options_module;
684 GList *load_module_node;
685 const gchar *child_chroot_parent_own_orbit_socket,*child_chroot_parent_own_orbit_dir;
688 g_return_if_fail(Vfs_IOR!=NULL);
689 /* 'child_chroot_pid_hashkey_dir' may be NULL */
690 g_return_if_fail(CAPTIVE_VFS_PARENT_IS_OBJECT(captive_vfs_parent_object));
692 Vfs_object=CORBA_ORB_string_to_object(captive_corba_orb,Vfs_IOR,&captive_corba_ev);
693 g_assert(validate_CORBA_Environment(&captive_corba_ev));
695 /* Init 'GLogFunc_object' */
696 GLogFunc_object=impl_Captive_GLogFunc__create(captive_corba_poa,captive_vfs_parent_object,&captive_corba_ev);
697 g_assert(validate_CORBA_Environment(&captive_corba_ev));
699 /* Init 'CaptiveIOChannel_object' */
700 if (!captive_vfs_parent_object->corba_parent_giochanel_blind_source) {
701 GIOChannel *giochannel;
703 giochannel=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.image_iochannel;
704 g_io_channel_ref(giochannel);
706 giochannel=captive_storage_relastblock(giochannel);
708 switch (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode) {
709 case CAPTIVE_OPTION_RWMODE_RO:
710 case CAPTIVE_OPTION_RWMODE_RW:
712 case CAPTIVE_OPTION_RWMODE_BLIND: {
713 GIOChannel *giochannel_orig;
715 giochannel_orig=giochannel;
716 giochannel=(GIOChannel *)captive_giochannel_blind_new(
717 giochannel, /* giochannel_orig */
718 TRUE); /* writeable */
719 g_io_channel_unref(giochannel_orig); /* reffed by captive_giochannel_blind_new() */
721 default: g_assert_not_reached();
723 captive_vfs_parent_object->corba_parent_giochanel_blind_source=giochannel;
726 if (!captive_vfs_parent_object->corba_parent_giochanel_blind)
727 captive_vfs_parent_object->corba_parent_giochanel_blind=(GIOChannel *)captive_giochannel_blind_new(
728 captive_vfs_parent_object->corba_parent_giochanel_blind_source, /* giochannel_orig */
729 (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode!=CAPTIVE_OPTION_RWMODE_RO)); /* writeable */
730 CaptiveIOChannel_object=impl_Captive_CaptiveIOChannel__create(captive_corba_poa,
731 captive_vfs_parent_object->corba_parent_giochanel_blind,&captive_corba_ev);
732 g_assert(validate_CORBA_Environment(&captive_corba_ev));
734 /* Create the socket needed for 'sandbox_parent_own_orbit_socket' below
735 * by CORBA_ORB_object_to_string()->ORBit_marshal_object()->IOP_generate_profiles()->ORBit_ORB_start_servers...
739 GLogFunc_IOR=CORBA_ORB_object_to_string(captive_corba_orb,GLogFunc_object,&captive_corba_ev);
740 g_assert(validate_CORBA_Environment(&captive_corba_ev));
741 g_assert(GLogFunc_IOR!=NULL);
742 CORBA_free(GLogFunc_IOR);
745 if (sandbox_parent_own_orbit_dir && !sandbox_parent_own_orbit_socket) {
747 struct dirent *dirent;
749 dir=opendir(sandbox_parent_own_orbit_dir);
752 while (errno=0,(dirent=readdir(dir))) {
753 if (!strcmp(dirent->d_name,".") || !strcmp(dirent->d_name,".."))
755 g_assert(sandbox_parent_own_orbit_socket==NULL);
756 sandbox_parent_own_orbit_socket=g_strdup_printf("%s/%s",sandbox_parent_own_orbit_dir,dirent->d_name);
759 errint=closedir(dir);
761 g_assert(sandbox_parent_own_orbit_socket!=NULL);
764 if (child_chroot_pid_hashkey_dir) {
767 child_chroot_parent_own_orbit_dir=captive_printf_alloca("%s/%s",child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_dir);
768 s=(/* de-const */ gchar *)child_chroot_parent_own_orbit_dir;
773 if (*child_chroot_parent_own_orbit_dir) {
774 errint=mkdir(child_chroot_parent_own_orbit_dir,0777);
776 g_assert(errno==EEXIST);
778 /* chmod(2) it to prevent mode limitation by
779 * active ulimit(2) of being executed by mount(8).
781 errint=chmod(child_chroot_parent_own_orbit_dir,0777);
788 child_chroot_parent_own_orbit_socket=captive_printf_alloca("%s/%s",
789 child_chroot_pid_hashkey_dir,sandbox_parent_own_orbit_socket);
790 errint=link(sandbox_parent_own_orbit_socket,child_chroot_parent_own_orbit_socket);
792 /* chmod(2)s also our orig. one (!) but this one is protected by its 0777 directory. */
793 errint=chmod(child_chroot_parent_own_orbit_socket,0666);
797 options_corba.g_log_func=CORBA_Object_duplicate(GLogFunc_object,&captive_corba_ev);
798 g_assert(validate_CORBA_Environment(&captive_corba_ev));
800 options_module_captive_to_options_module_corba(&options_corba.filesystem,&CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.filesystem);
801 /* Prevent secondary captive_giochannel_blind inside of our sandbox child
802 * as we already have one captive_giochannel_blind in the parent.
804 options_corba.rwmode =(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode == CAPTIVE_OPTION_RWMODE_BLIND ? CAPTIVE_OPTION_RWMODE_RW
805 : CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.rwmode);
806 options_corba.media =CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.media;
807 options_corba.debug_messages=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.debug_messages;
809 options_corba.image_iochannel=CORBA_Object_duplicate(CaptiveIOChannel_object,&captive_corba_ev);
810 g_assert(validate_CORBA_Environment(&captive_corba_ev));
812 load_module_length=g_list_length(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module);
813 options_corba.load_module._maximum=load_module_length;
814 options_corba.load_module._length=load_module_length;
815 options_corba.load_module._buffer=Captive_CaptiveOptionsModuleList_allocbuf(options_corba.load_module._maximum);
816 options_corba.load_module._release=TRUE;
817 for (load_moduleui=0,load_module_node=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.load_module;
819 load_moduleui++,load_module_node=load_module_node->next) {
820 options_module=load_module_node->data;
821 options_module_captive_to_options_module_corba(options_corba.load_module._buffer+load_moduleui,options_module);
824 Captive_Vfs_init(Vfs_object,&options_corba,&captive_corba_ev);
825 g_assert(validate_CORBA_Environment(&captive_corba_ev));
827 Captive_CaptiveOptions__freekids(&options_corba,
828 NULL); /* d; unused */
830 captive_vfs_parent_object->corba_Vfs_object=Vfs_object;
831 captive_vfs_parent_object->corba_GLogFunc_object=GLogFunc_object;
832 captive_vfs_parent_object->corba_CaptiveIOChannel_object=CaptiveIOChannel_object;
834 if (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.bug_pathname)
835 sandbox_parent_bug_doc_make(captive_vfs_parent_object);
838 static void fd_shiftup(int *fdp)
840 g_return_if_fail(fdp!=NULL);
842 while (*fdp<=2 /* STDERR */) {
848 void captive_sandbox_fd_closeup(int fd_first_to_delete)
853 struct dirent *dirent;
855 dir=opendir("/proc/self/fd/");
856 g_return_if_fail(dir!=NULL);
858 g_return_if_fail(dir_fd!=-1);
860 while (errno=0,(dirent=readdir(dir))) {
865 || !strcmp(dirent->d_name,".")
866 || !strcmp(dirent->d_name,".."))
868 dirent_fd=strtol(dirent->d_name,&endptr,10 /* base */);
869 g_assert(dirent_fd>=0 && (!endptr || !*endptr));
870 if (dirent_fd<fd_first_to_delete || dirent_fd==dir_fd)
873 errint=close(dirent_fd);
876 errint=close(dirent_fd);
877 g_assert(errint==-1); g_assert(errno==EBADF);
879 g_return_if_fail(errno==0); /* check for EOF */
881 errint=closedir(dir);
882 g_return_if_fail(errint==0);
884 close(dir_fd); g_assert(errno==EBADF); /* just a bit of paranoia; it should be already closed by closedir() */
887 gboolean captive_sandbox_spawn(CaptiveVfsParentObject *captive_vfs_parent_object)
889 /* Vfs_IOR_fds[0] for reading by sandbox_parent() - client,
890 * Vfs_IOR_fds[1] for writing by sandbox_child() - server
892 int Vfs_IOR_fds[2],parentheart_fds[2];
896 g_return_val_if_fail(CAPTIVE_VFS_PARENT_IS_OBJECT(captive_vfs_parent_object),FALSE);
898 errint=pipe(Vfs_IOR_fds);
899 g_return_val_if_fail(errint==0,FALSE);
900 errint=pipe(parentheart_fds);
901 g_return_val_if_fail(errint==0,FALSE);
903 /* Currently never called anywhere:
904 * errbool=corba_shutdown(&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
905 * g_assert(errbool==TRUE);
908 if (CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior) {
909 g_assert(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv==NULL);
911 errbool=corba_init("captive-sandbox-parent",&captive_corba_ev,&captive_corba_orb,&captive_corba_poa);
912 g_assert(errbool==TRUE);
914 captive_vfs_parent_object->corba_parentheart_fds_1=-1;
915 captive_vfs_parent_object->corba_child_pid=-1;
917 CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior, /* Vfs_IOR */
918 NULL, /* child_chroot_pid_hashkey_dir */
919 captive_vfs_parent_object); /* captive_vfs_parent_object */
923 g_assert(CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv!=NULL);
924 switch ((captive_vfs_parent_object->corba_child_pid=fork())) {
926 g_return_val_if_reached(FALSE);
928 case 0: { /* child */
929 const char *sandbox_argv0;
932 errint=close(Vfs_IOR_fds[0]); /* close Vfs_IOR_fd_read */
933 g_return_val_if_fail(errint==0,FALSE);
934 errint=close(parentheart_fds[1]); /* close parentheart_fd_write */
935 g_return_val_if_fail(errint==0,FALSE);
937 fd_shiftup(Vfs_IOR_fds+1); /* Vfs_IOR_fd_write */
938 fd_shiftup(parentheart_fds+0); /* parentheart_fd_read */
939 errint=dup2(Vfs_IOR_fds[1],1 /* STDOUT */); /* Vfs_IOR_fd_write */
940 g_return_val_if_fail(errint==1 /* STDOUT */,FALSE);
941 errint=dup2(parentheart_fds[0],0 /* STDIN */); /* parentheart_fd_read */
942 g_return_val_if_fail(errint==0 /* STDIN */,FALSE);
944 captive_sandbox_fd_closeup(2 /* STDERR */ +1);
946 sandbox_argv0=CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv[0];
947 execv_rc=execv(sandbox_argv0,
948 /* re-const */ (char * const *)CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv);
949 g_error(_("Failed to spawn sandbox server - execv(\"%s\",...)=%d: %m"),sandbox_argv0,execv_rc);
952 default: { /* parent */
954 gchar *child_chroot_pid_hashkey_dir;
956 errint=close(Vfs_IOR_fds[1]); /* close Vfs_IOR_fd_write */
957 g_return_val_if_fail(errint==0,FALSE);
958 errint=close(parentheart_fds[0]); /* close parentheart_fd_read */
959 g_return_val_if_fail(errint==0,FALSE);
960 errint=fcntl(parentheart_fds[1],F_SETFD,FD_CLOEXEC);
961 /* This fcntl(2) may not be enough - some fork(2) may duplicate this
962 * write descriptor and even if we do some process finish the child
963 * may remain alone connected with some unknown fork(2)er from us.
964 * Currently I am not aware such case would occur.
966 g_return_val_if_fail(errint==0,FALSE);
967 captive_vfs_parent_object->corba_parentheart_fds_1=parentheart_fds[1];
969 Vfs_IOR=sandbox_parent_read_ior(
970 Vfs_IOR_fds[0], /* Vfs_IOR_fd_read */
971 &child_chroot_pid_hashkey_dir,
972 captive_vfs_parent_object);
975 Vfs_IOR, /* Vfs_IOR */
976 child_chroot_pid_hashkey_dir, /* child_chroot_pid_hashkey_dir */
977 captive_vfs_parent_object); /* captive_vfs_parent_object */
980 g_free(child_chroot_pid_hashkey_dir);
982 /* 'parentheart_fds[1]' - parentheart_fd_write - is left open here */
987 g_return_val_if_reached(FALSE);
991 GnomeVFSResult captive_sandbox_parent_return_from_CORBA_Environment
992 (CORBA_Environment *evp,CaptiveVfsParentObject *captive_vfs_parent_object)
996 if (evp->_major==CORBA_NO_EXCEPTION)
999 /* If !CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv it is CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_ior
1000 * where we cannot do any restart anyway.
1002 if (captive_vfs_parent_object && CAPTIVE_VFS_OBJECT(captive_vfs_parent_object)->options.sandbox_server_argv
1003 && (evp->_major==CORBA_SYSTEM_EXCEPTION && !strcmp(ex_CORBA_COMM_FAILURE,CORBA_exception_id(evp)))) {
1004 r=GNOME_VFS_ERROR_SERVICE_NOT_AVAILABLE;
1005 if (captive_vfs_parent_object->corba_Vfs_object!=CORBA_OBJECT_NIL)
1006 captive_vfs_parent_object_aborted(captive_vfs_parent_object); /* errors ignored */
1008 else if (evp->_major==CORBA_USER_EXCEPTION && !strcmp(ex_Captive_GnomeVFSResultException,CORBA_exception_id(evp))) {
1009 r=((Captive_GnomeVFSResultException *)CORBA_exception_value(evp))->gnome_vfs_result;
1010 g_assert(r!=GNOME_VFS_ERROR_SERVICE_NOT_AVAILABLE); /* code reserved for sandbox restarts */
1013 r=GNOME_VFS_ERROR_GENERIC;
1014 g_warning(_("CORBA Exception occured: id=\"%s\", value=%p"),
1015 CORBA_exception_id(evp),CORBA_exception_value(evp));
1017 CORBA_exception_free(evp);
1023 void captive_sandbox_child_GnomeVFSResultException_throw(CORBA_Environment *evp,GnomeVFSResult errvfsresult)
1025 Captive_GnomeVFSResultException *gnome_vfs_result_exception;
1027 g_return_if_fail(evp!=NULL);
1029 gnome_vfs_result_exception=Captive_GnomeVFSResultException__alloc();
1030 gnome_vfs_result_exception->gnome_vfs_result=errvfsresult;
1031 CORBA_exception_set(evp,CORBA_USER_EXCEPTION,ex_Captive_GnomeVFSResultException,gnome_vfs_result_exception);