qssb.h

@@ -102,7 +102,7 @@ struct qssb_policy
 	int syscall_default_policy;
 	int *blacklisted_syscalls;
 	int *allowed_syscalls;
-	char chroot_target_path[PATH_MAX];
+	const char *chroot_target_path;
 	const char *chdir_path;
 	struct qssb_path_policy *path_policies;
 };
@@ -120,7 +120,7 @@ struct qssb_policy *qssb_init_policy()
 	result->no_new_privs = 1;
 	result->namespace_options = QSSB_UNSHARE_MOUNT | QSSB_UNSHARE_USER;
 	result->chdir_path = NULL;
-	result->chroot_target_path[0] = '\0';
+	result->chroot_target_path = NULL;
 	result->path_policies = NULL;
 	return result;
 }
@@ -298,7 +298,7 @@ static int mount_to_chroot(const char *chroot_target_path, struct qssb_path_poli
 
 /* Ends the policy as best as possible. */
 /* TODO: can this function do actually anything useful?*/
-int qssb_end_policy(struct qssb_policy *ctxt)
+static int qssb_end_policy(struct qssb_policy *ctxt)
 {
 	return 0;
 }
@@ -306,7 +306,7 @@ int qssb_end_policy(struct qssb_policy *ctxt)
 /*
  * Frees the memory taken by a qssb_policy object
  */
-void qssb_free_policy(struct qssb_policy *ctxt)
+static void qssb_free_policy(struct qssb_policy *ctxt)
 {
 	free(ctxt);
 }
@@ -491,10 +491,11 @@ int qssb_enable_policy(struct qssb_policy *policy)
 	{
 		if(policy->chroot_target_path == NULL)
 		{
+			char *target_dir = (char *) calloc(1, PATH_MAX * sizeof(char));
 			char random_str[17];
 			if(random_string(random_str, sizeof(random_str)) == 16)
 			{
-				int res = snprintf(policy->chroot_target_path, sizeof(policy->chroot_target_path), "%s/.sandbox_%" PRIdMAX "_%s", QSSB_TEMP_DIR, (intmax_t)getpid(), random_str);
+				int res = snprintf(target_dir, PATH_MAX, "%s/.sandbox_%" PRIdMAX "_%s", QSSB_TEMP_DIR, (intmax_t)getpid(), random_str);
 				if(res < 0)
 				{
 					QSSB_LOG_ERROR("qssb: qssb_enable_policy: error during path concatination\n");
@@ -505,6 +506,7 @@ int qssb_enable_policy(struct qssb_policy *policy)
 					QSSB_LOG_ERROR("qssb: qssb_enable_policy: path concatination truncated\n");
 					return -EINVAL;
 				}
+				policy->chroot_target_path = target_dir;
 			}
 			else
 			{