diff options
| author |   Mike Frysinger <vapier@gentoo.org> | 2021-10-18 02:47:59 -0400 |
|---|---|---|
| committer | Mike Frysinger <vapier@gentoo.org> | 2021-10-18 02:47:59 -0400 |
| commit | c4bf07615cd2e2ec25a16420d8ddee2efec6f8d2 (patch) | |
| tree | 17cba0cfb546f72d1657d1380e30c5c88027d8b6 /libsbutil | |
| parent | libsbutil: add assert to testing code path (diff) | |
| download | sandbox-c4bf07615cd2e2ec25a16420d8ddee2efec6f8d2.tar.gz sandbox-c4bf07615cd2e2ec25a16420d8ddee2efec6f8d2.tar.bz2 sandbox-c4bf07615cd2e2ec25a16420d8ddee2efec6f8d2.zip | |
libsandbox: add SANDBOX_METHOD setting
This allows people to disable use of ptrace if their configuration
does not support it. This forces older sandbox behavior where we
cannot protect against static or set*id programs.
Bug: https://bugs.gentoo.org/648516
Bug: https://bugs.gentoo.org/771360
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Diffstat (limited to 'libsbutil')
| -rw-r--r-- | libsbutil/Makefile.am | 1 | ||||
| -rw-r--r-- | libsbutil/sb_method.c | 34 | ||||
| -rw-r--r-- | libsbutil/sbutil.h | 11 |
3 files changed, 46 insertions, 0 deletions
diff --git a/libsbutil/Makefile.am b/libsbutil/Makefile.am index 684d126..06de7d3 100644 --- a/libsbutil/Makefile.am +++ b/libsbutil/Makefile.am @@ -22,6 +22,7 @@ libsbutil_la_SOURCES = \ sb_backtrace.c \ sb_efuncs.c \ sb_gdb.c \ + sb_method.c \ sb_open.c \ sb_read.c \ sb_write.c \ diff --git a/libsbutil/sb_method.c b/libsbutil/sb_method.c new file mode 100644 index 0000000..b2d62a7 --- /dev/null +++ b/libsbutil/sb_method.c @@ -0,0 +1,34 @@ +/* + * sb_method.c + * + * Util functions for sandbox method settings. + * + * Copyright 2021 Gentoo Foundation + * Licensed under the GPL-2 + */ + +#include "headers.h" +#include "sbutil.h" + +sandbox_method_t parse_sandbox_method(const char *method) +{ + if (method == NULL || streq(method, "") || streq(method, "any")) + return SANDBOX_METHOD_ANY; + + if (streq(method, "preload")) + return SANDBOX_METHOD_PRELOAD; + + return SANDBOX_METHOD_ANY; +} + +const char *str_sandbox_method(sandbox_method_t method) +{ + switch (method) { + case SANDBOX_METHOD_PRELOAD: + return "preload"; + case SANDBOX_METHOD_ANY: + return "any"; + default: + return ""; + } +} diff --git a/libsbutil/sbutil.h b/libsbutil/sbutil.h index 66c6f73..5194dde 100644 --- a/libsbutil/sbutil.h +++ b/libsbutil/sbutil.h @@ -54,6 +54,7 @@ #define ENV_SANDBOX_WRITE "SANDBOX_WRITE" #define ENV_SANDBOX_PREDICT "SANDBOX_PREDICT" +#define ENV_SANDBOX_METHOD "SANDBOX_METHOD" #define ENV_SANDBOX_ON "SANDBOX_ON" #define ENV_SANDBOX_ACTIVE "SANDBOX_ACTIVE" @@ -84,6 +85,13 @@ static inline bool is_env_var(const char *env, const char *var, size_t vlen) return !strncmp(env, var, vlen) && env[vlen] == '='; } +typedef enum sandbox_method_t { + SANDBOX_METHOD_ANY = 0, + SANDBOX_METHOD_PRELOAD, +} sandbox_method_t; +sandbox_method_t parse_sandbox_method(const char *); +const char *str_sandbox_method(sandbox_method_t); + /* proc helpers */ extern const char sb_fd_dir[]; #define sb_get_fd_dir() sb_fd_dir @@ -145,6 +153,9 @@ char *__xstrndup(const char *str, size_t size, const char *file, const char *fun #define xstrndup(_str, _size) __xstrndup(_str, _size, __FILE__, __func__, __LINE__) #define xalloc_die() __sb_ebort(__FILE__, __func__, __LINE__, "out of memory") +/* string helpers */ +#define streq(s1, s2) (strcmp(s1, s2) == 0) + /* errno helpers */ #define save_errno() int old_errno = errno; #define restore_errno() errno = old_errno; |