crtxcr/cgitsb
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sandboxing: sync with qssb.h upstream + isolate network

Browse Source
This commit is contained in:
Albert S. 2019-11-17 12:51:45 +01:00
parent d9c9cbd5a2
commit 6fdf5f8f5a
2 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
cgit.c
View File

@ -1049,24 +1049,27 @@ static int calc_ttl(void)
void enable_sandbox() void enable_sandbox()
{ {
struct qssb_policy *policy = qssb_init_policy(); struct qssb_policy *policy = qssb_init_policy();
struct qssb_path_policy dev_policy;
size_t allowed_paths_length = cgit_repolist.count+2; //TODO: drop this once qssb can create some minimal /dev itself
char **allowed_paths = malloc(sizeof(char *) * allowed_paths_length); dev_policy.mountpoint = "/dev/";
allowed_paths[0] = "/dev/"; //TODO: drop this once qssb can create some minimal /dev itself dev_policy.policy = QSSB_MOUNT_ALLOW_READ | QSSB_MOUNT_ALLOW_DEV;
dev_policy.next = malloc(sizeof(struct qssb_path_policy));
struct qssb_path_policy **current_target = &dev_policy.next;
for(int i = 0; i < cgit_repolist.count; i++) for(int i = 0; i < cgit_repolist.count; i++)
{ {
struct cgit_repo *current = &cgit_repolist.repos[i]; *current_target = malloc(sizeof(struct qssb_path_policy));
allowed_paths[i+1] = current->path; (*current_target)->mountpoint = cgit_repolist.repos[i].path;
(*current_target)->policy = QSSB_MOUNT_ALLOW_READ;
(*current_target)->next = NULL;
current_target = &(*current_target)->next;
} }
allowed_paths[allowed_paths_length-1] = NULL; policy->path_policies = &dev_policy;
policy->readonly_paths = allowed_paths; policy->namespace_options |= QSSB_UNSHARE_NETWORK;
if(qssb_enable_policy(policy) != 0) if(qssb_enable_policy(policy) != 0)
{ {
fprintf(stderr, "%s", "Failed to init sandbox\n"); fprintf(stderr, "%s", "Failed to init sandbox\n");
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
free(allowed_paths);
qssb_free_policy(policy); qssb_free_policy(policy);
} }

2
qssb

@ -1 +1 @@
Subproject commit 1635ffce087130ca25f97a31841c9d28f7808b87 Subproject commit 8f104a231cf63c39569d60bbd5d379f728f89ca9