Attachment #516940 for bug #599706




	    sb_nr == SB_NR_CHOWN       ||
	    sb_nr == SB_NR_CREAT       ||
	    sb_nr == SB_NR_CREAT64     ||
	    sb_nr == SB_NR_FCHMOD      ||
	    sb_nr == SB_NR_FCHMODAT    ||
	    sb_nr == SB_NR_FCHOWN      ||
	    sb_nr == SB_NR_FCHOWNAT    ||
	  /*sb_nr == SB_NR_FTRUNCATE   ||
	    sb_nr == SB_NR_FTRUNCATE64 ||*/

	return before_syscall(dirfd, sb_nr, ext_func, file, 0);
}

bool before_syscall_fd(int sb_nr, const char *func, int fd) {
#ifdef __linux__
	/* We only know how to handle e.g. fchmod() and fchown() on
	 * linux, where it's possible to (eventually) get a path out
	 * of the given file descriptor. The "64" below accounts for
	 * the length of an integer string, and is probably
	 * overkill. */
	char path[sizeof("/proc/self/fd/") + 64];
	snprintf(path, sizeof("/proc/self/fd/") + 64, "/proc/self/fd/%i", fd);
	return before_syscall(AT_FDCWD, sb_nr, func, path, 0);
#else
	return true;
#endif
}



typedef struct {
	const char *name;
	size_t len;




#define  SB_SAFE_OPEN_CHAR(_path, _mode) \
         SB_SAFE_OPEN_CHAR_AT(AT_FDCWD, _path, _mode)

#define _SB_SAFE_FD(_nr, _name, _fd) \
        __SB_SAFE(before_syscall_fd(_nr, _name, fd))
#define  SB_SAFE_FD(_fd) \
         _SB_SAFE_FD(WRAPPER_NR, STRING_NAME, _fd)

bool is_sandbox_on(void);
bool before_syscall(int, int, const char *, const char *, int);
bool before_syscall_access(int, int, const char *, const char *, int);
bool before_syscall_open_int(int, int, const char *, const char *, int);
bool before_syscall_open_char(int, int, const char *, const char *, const char *);
bool before_syscall_fd(int, const char *, int);

void *get_dlsym(const char *symname, const char *symver);


Lines 7-14 Link Here

(-)a/libsandbox/symbols.h.in (+2 lines)
7	# before 'creat()' as 'creat()' uses 'open()' ...	7	# before 'creat()' as 'creat()' uses 'open()' ...
8		8
9	chmod	9	chmod
		10	fchmod
10	fchmodat	11	fchmodat
11	chown	12	chown
		13	fchown
12	fchownat	14	fchownat
13	open	15	open
14	__open_2	16	__open_2




			ret = 1;
		free(path);
		return ret;

	} else if (nr == SB_NR_FCHMOD) {
	  int fd = trace_arg(regs, 1);
	  mode_t mode = trace_arg(regs, 2);
	  __sb_debug("(%i, %o)", fd, mode);
	  return _SB_SAFE_FD(nr, name, fd);

	} else if (nr == SB_NR_FCHOWN) {
	  int fd = trace_arg(regs, 1);
	  uid_t uid = trace_arg(regs, 2);
	  gid_t gid = trace_arg(regs, 3);
	  __sb_debug("(%i, %i, %i)", fd, uid, gid);
	  return _SB_SAFE_FD(nr, name, fd);
	}

 done:

Line 0 Link Here

(-)a/libsandbox/wrapper-funcs/fchmod.c (+11 lines)
	1	/*
	2	* fchmod() wrapper.
	3	*
	4	* Copyright 1999-2018 Gentoo Foundation
	5	* Licensed under the GPL-2
	6	*/
	7
	8	#define WRAPPER_ARGS_PROTO int fd, mode_t mode
	9	#define WRAPPER_ARGS fd, mode
	10	#define WRAPPER_SAFE() SB_SAFE_FD(fd)
	11	#include "__wrapper_simple.c"

Line 0 Link Here

(-)a/libsandbox/wrapper-funcs/fchown.c (-1 / +11 lines)
0	-	1	/*
		2	* fchown() wrapper.
		3	*
		4	* Copyright 1999-2018 Gentoo Foundation
		5	* Licensed under the GPL-2
		6	*/
		7
		8	#define WRAPPER_ARGS_PROTO int fd, uid_t owner, gid_t group
		9	#define WRAPPER_ARGS fd, owner, group
		10	#define WRAPPER_SAFE() SB_SAFE_FD(fd)
		11	#include "__wrapper_simple.c"

Return to bug 599706

Lines 752-758 static int check_access(sbcontext_t sbcontext, int sb_nr, const char func, Link Here

(-)a/libsandbox/libsandbox.c (+19 lines)
752	sb_nr == SB_NR_CHOWN \|\|	752	sb_nr == SB_NR_CHOWN \|\|
753	sb_nr == SB_NR_CREAT \|\|	753	sb_nr == SB_NR_CREAT \|\|
754	sb_nr == SB_NR_CREAT64 \|\|	754	sb_nr == SB_NR_CREAT64 \|\|
		755	sb_nr == SB_NR_FCHMOD \|\|
755	sb_nr == SB_NR_FCHMODAT \|\|	756	sb_nr == SB_NR_FCHMODAT \|\|
		757	sb_nr == SB_NR_FCHOWN \|\|
756	sb_nr == SB_NR_FCHOWNAT \|\|	758	sb_nr == SB_NR_FCHOWNAT \|\|
757	/*sb_nr == SB_NR_FTRUNCATE \|\|	759	/*sb_nr == SB_NR_FTRUNCATE \|\|
758	sb_nr == SB_NR_FTRUNCATE64 \|\|*/	760	sb_nr == SB_NR_FTRUNCATE64 \|\|*/
Lines 1094-1099 bool before_syscall_open_char(int dirfd, int sb_nr, const char *func, const char Link Here
1094	return before_syscall(dirfd, sb_nr, ext_func, file, 0);	1096	return before_syscall(dirfd, sb_nr, ext_func, file, 0);
1095	}	1097	}
1096		1098
		1099	bool before_syscall_fd(int sb_nr, const char *func, int fd) {
		1100	#ifdef __linux__
		1101	/* We only know how to handle e.g. fchmod() and fchown() on
		1102	* linux, where it's possible to (eventually) get a path out
		1103	* of the given file descriptor. The "64" below accounts for
		1104	* the length of an integer string, and is probably
		1105	* overkill. */
		1106	char path[sizeof("/proc/self/fd/") + 64];
		1107	snprintf(path, sizeof("/proc/self/fd/") + 64, "/proc/self/fd/%i", fd);
		1108	return before_syscall(AT_FDCWD, sb_nr, func, path, 0);
		1109	#else
		1110	return true;
		1111	#endif
		1112	}
		1113
		1114
		1115
1097	typedef struct {	1116	typedef struct {
1098	const char *name;	1117	const char *name;
1099	size_t len;	1118	size_t len;

Lines 46-56 Link Here

(-)a/libsandbox/libsandbox.h (+6 lines)
46	#define SB_SAFE_OPEN_CHAR(_path, _mode) \	46	#define SB_SAFE_OPEN_CHAR(_path, _mode) \
47	SB_SAFE_OPEN_CHAR_AT(AT_FDCWD, _path, _mode)	47	SB_SAFE_OPEN_CHAR_AT(AT_FDCWD, _path, _mode)
48		48
		49	#define _SB_SAFE_FD(_nr, _name, _fd) \
		50	__SB_SAFE(before_syscall_fd(_nr, _name, fd))
		51	#define SB_SAFE_FD(_fd) \
		52	_SB_SAFE_FD(WRAPPER_NR, STRING_NAME, _fd)
		53
49	bool is_sandbox_on(void);	54	bool is_sandbox_on(void);
50	bool before_syscall(int, int, const char , const char , int);	55	bool before_syscall(int, int, const char , const char , int);
51	bool before_syscall_access(int, int, const char , const char , int);	56	bool before_syscall_access(int, int, const char , const char , int);
52	bool before_syscall_open_int(int, int, const char , const char , int);	57	bool before_syscall_open_int(int, int, const char , const char , int);
53	bool before_syscall_open_char(int, int, const char , const char , const char *);	58	bool before_syscall_open_char(int, int, const char , const char , const char *);
		59	bool before_syscall_fd(int, const char *, int);
54		60
55	void get_dlsym(const char symname, const char *symver);	61	void get_dlsym(const char symname, const char *symver);
56		62

Lines 421-426 static bool trace_check_syscall(const struct syscall_entry se, void regs) Link Here

(-)a/libsandbox/trace.c (+13 lines)
421	ret = 1;	421	ret = 1;
422	free(path);	422	free(path);
423	return ret;	423	return ret;
		424
		425	} else if (nr == SB_NR_FCHMOD) {
		426	int fd = trace_arg(regs, 1);
		427	mode_t mode = trace_arg(regs, 2);
		428	__sb_debug("(%i, %o)", fd, mode);
		429	return _SB_SAFE_FD(nr, name, fd);
		430
		431	} else if (nr == SB_NR_FCHOWN) {
		432	int fd = trace_arg(regs, 1);
		433	uid_t uid = trace_arg(regs, 2);
		434	gid_t gid = trace_arg(regs, 3);
		435	__sb_debug("(%i, %i, %i)", fd, uid, gid);
		436	return _SB_SAFE_FD(nr, name, fd);
424	}	437	}
425		438
426	done:	439	done: