Confronta commit
No commits in common. "32544c8f680a57111d24da5bd4be17548f3379ed" and "55701541137069b92513dd31c0b90f3f435bccf4" have entirely different histories.
32544c8f68
...
5570154113
6
.gitmodules
esterno
6
.gitmodules
esterno
@ -4,6 +4,6 @@
|
||||
[submodule "submodules/cpp-httplib"]
|
||||
path = submodules/cpp-httplib
|
||||
url = https://github.com/yhirose/cpp-httplib
|
||||
[submodule "submodules/exile.h"]
|
||||
path = submodules/exile.h
|
||||
url = https://gitea.quitesimple.org/crtxcr/exile.h.git
|
||||
[submodule "submodules/qssb.h"]
|
||||
path = submodules/qssb.h
|
||||
url = https://gitea.quitesimple.org/crtxcr/qssb.h.git
|
||||
|
2
Makefile
2
Makefile
@ -3,7 +3,7 @@ CPPSTD=c++20
|
||||
CXXFLAGS=-std=$(CPPSTD) -O0 -g -no-pie -pipe -MMD -Wall -Wextra
|
||||
RELEASE_CXXFLAGS=-std=$(CPPSTD) -O3 -pipe -MMD -Wall -Wextra
|
||||
LDFLAGS=-lsqlite3 -lpthread -lcrypto -lstdc++fs
|
||||
INCLUDEFLAGS=-I submodules/sqlitemoderncpp/hdr -I submodules/cpp-httplib -I submodules/exile.h
|
||||
INCLUDEFLAGS=-I submodules/sqlitemoderncpp/hdr -I submodules/cpp-httplib -I submodules/qssb.h
|
||||
|
||||
CXX=g++
|
||||
|
||||
|
@ -72,7 +72,8 @@ Building
|
||||
Dependencies:
|
||||
- cpp-httplib: https://github.com/yhirose/cpp-httplib
|
||||
- SqliteModernCpp: https://github.com/SqliteModernCpp
|
||||
- exile.h: https://gitea.quitesimple.org/crtxcr/exile.h
|
||||
- qssb.h: https://gitea.quitesimple.org/crtxcr/qssb.h
|
||||
- libseccomp: https://github.com/seccomp/libseccomp
|
||||
- sqlite3: https://sqlite.org/index.html
|
||||
|
||||
The first three are header-only libraries that are included as a git submodule. The others must
|
||||
|
@ -13,7 +13,7 @@
|
||||
#include <sys/mount.h>
|
||||
#include <sys/capability.h>
|
||||
#define HAVE_LANDLOCK 0
|
||||
#include <exile.h>
|
||||
#include <qssb.h>
|
||||
#include "../logger.h"
|
||||
#include "../utils.h"
|
||||
#include "../random.h"
|
||||
@ -46,7 +46,7 @@ bool SandboxLinux::enable(std::vector<std::string> fsPaths)
|
||||
std::sort(fsPaths.begin(), fsPaths.end(),
|
||||
[](const std::string &a, const std::string &b) { return a.length() < b.length(); });
|
||||
|
||||
struct exile_policy *policy = exile_init_policy();
|
||||
struct qssb_policy *policy = qssb_init_policy();
|
||||
if(policy == NULL)
|
||||
{
|
||||
Logger::error() << "Failed to init sandboxing policy (worker) ";
|
||||
@ -54,37 +54,37 @@ bool SandboxLinux::enable(std::vector<std::string> fsPaths)
|
||||
}
|
||||
for(unsigned int i = 0; i < fsPaths.size(); i++)
|
||||
{
|
||||
exile_append_path_policy(policy, EXILE_FS_ALLOW_READ | EXILE_FS_ALLOW_WRITE, fsPaths[i].c_str());
|
||||
qssb_append_path_policy(policy, QSSB_FS_ALLOW_READ | QSSB_FS_ALLOW_WRITE, fsPaths[i].c_str());
|
||||
}
|
||||
policy->drop_caps = 1;
|
||||
policy->not_dumpable = 1;
|
||||
policy->no_new_privs = 1;
|
||||
policy->mount_path_policies_to_chroot = 1;
|
||||
|
||||
if(exile_append_group_syscall_policy(policy, EXILE_SYSCALL_ALLOW, EXILE_SYSCGROUP_DEFAULT_ALLOW) != 0)
|
||||
if(qssb_append_group_syscall_policy(policy, QSSB_SYSCALL_ALLOW, QSSB_SYSCGROUP_DEFAULT_ALLOW) != 0)
|
||||
{
|
||||
Logger::error() << "Sandbox: Failed to add whitelist!";
|
||||
exile_free_policy(policy);
|
||||
qssb_free_policy(policy);
|
||||
return false;
|
||||
}
|
||||
if(exile_append_group_syscall_policy(policy, EXILE_SYSCALL_ALLOW, EXILE_SYSCGROUP_SOCKET | EXILE_SYSCGROUP_FUTEX | EXILE_SYSCGROUP_PATH | EXILE_SYSCGROUP_SCHED | EXILE_SYSCGROUP_TIME) != 0)
|
||||
if(qssb_append_group_syscall_policy(policy, QSSB_SYSCALL_ALLOW, QSSB_SYSCGROUP_SOCKET | QSSB_SYSCGROUP_FUTEX | QSSB_SYSCGROUP_PATH | QSSB_SYSCGROUP_SCHED) != 0)
|
||||
{
|
||||
Logger::error() << "Sandbox: Failed to add socket group!";
|
||||
exile_free_policy(policy);
|
||||
qssb_free_policy(policy);
|
||||
return false;
|
||||
}
|
||||
if(exile_append_syscall_default_policy(policy, EXILE_SYSCALL_DENY_KILL_PROCESS) != 0)
|
||||
if(qssb_append_syscall_default_policy(policy, QSSB_SYSCALL_DENY_KILL_PROCESS) != 0)
|
||||
{
|
||||
Logger::error() << "Sandbox: Default policy";
|
||||
exile_free_policy(policy);
|
||||
qssb_free_policy(policy);
|
||||
return false;
|
||||
}
|
||||
if(exile_enable_policy(policy) != 0)
|
||||
if(qssb_enable_policy(policy) != 0)
|
||||
{
|
||||
Logger::error() << "Sandbox: Activation of seccomp blacklist failed!";
|
||||
exile_free_policy(policy);
|
||||
qssb_free_policy(policy);
|
||||
return false;
|
||||
}
|
||||
exile_free_policy(policy);
|
||||
qssb_free_policy(policy);
|
||||
return true;
|
||||
}
|
||||
|
@ -1 +1 @@
|
||||
Subproject commit 824e7682e4d95e1bb21e501731eb2b6bb23033d2
|
||||
Subproject commit 4f8fcdbaf7696a17c407cdd498819a7c7200c73b
|
@ -1 +0,0 @@
|
||||
Subproject commit 1b4c5477a55191f74d29bc264678e041bf0f2a42
|
1
submodules/qssb.h
Submodule
1
submodules/qssb.h
Submodule
@ -0,0 +1 @@
|
||||
Subproject commit d847d0f996679c77741b85959988dd9e65d63b97
|
Caricamento…
Fai riferimento in un nuovo problema
Block a user