Testcase to demonstrate the bug (require static.c)

sandbox_exec_bug.c (text/plain), 1.52 KB, created by Victor Stinner on 2011-04-25 23:55:31 UTC

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/wait.h>

void cloexec(int fd)
{
    int flags;

    flags = fcntl(fd, F_GETFD);
    if (flags == -1) {
        perror("fcntl(F_GETFD)");
        exit(1);
    }
    fcntl(fd, F_SETFD, flags | FD_CLOEXEC);
}

int main()
{
    int err;
    pid_t child;
    int outpipe[2];
    int errpipe[2];
    ssize_t n;
    char buffer[4096];
    char* child_argv[] = {"./static", NULL};

    err = pipe(outpipe);
    if (err) {
        perror("open");
        exit(1);
    }

    err = pipe(errpipe);
    if (err) {
        perror("open");
        exit(1);
    }
    cloexec(errpipe[0]);
    cloexec(errpipe[1]);

    child = fork();
    if (child < 0) {
        perror("fork");
        exit(1);
    }
    if (child == 0) {
        close(outpipe[0]);
        close(errpipe[0]);

        dup2(outpipe[1], 1);
        execv("./static", child_argv);

        perror("execl");
        exit(1);
    } else {
        close(outpipe[1]);
        close(errpipe[1]);

        printf("wait errpipe..."); fflush(stdout);
        n = read(errpipe[0], buffer, sizeof(buffer));
        if (n < 0) {
            perror("fcntl(F_GETFD)");
            exit(1);
        }
        printf(" done\n");

        while (1) {
            n = read(outpipe[0], buffer, sizeof(buffer));
            if (n < 0) {
                perror("fcntl(F_GETFD)");
                exit(1);
            }
            if (n == 0)
                break;
        }

        waitpid(child, NULL, 0);
        exit(0);
    }
}