diff options
Diffstat (limited to 'helper/bwrap/sequential.go')
| -rw-r--r-- | helper/bwrap/sequential.go | 273 |
1 files changed, 0 insertions, 273 deletions
diff --git a/helper/bwrap/sequential.go b/helper/bwrap/sequential.go deleted file mode 100644 index 53ab8aae..00000000 --- a/helper/bwrap/sequential.go +++ /dev/null @@ -1,273 +0,0 @@ -package bwrap - -import ( - "encoding/gob" - "fmt" - "io" - "os" - "strconv" - - "git.gensokyo.uk/security/fortify/helper/proc" -) - -func init() { - gob.Register(new(PermConfig[SymlinkConfig])) - gob.Register(new(PermConfig[*TmpfsConfig])) - gob.Register(new(OverlayConfig)) - gob.Register(new(DataConfig)) -} - -type PositionalArg int - -func (p PositionalArg) String() string { return positionalArgs[p] } - -const ( - Tmpfs PositionalArg = iota - Symlink - - Bind - BindTry - DevBind - DevBindTry - ROBind - ROBindTry - - Chmod - Dir - RemountRO - Procfs - DevTmpfs - Mqueue - - Perms - Size - - OverlaySrc - Overlay - TmpOverlay - ROOverlay - - SyncFd - Seccomp - - File - BindData - ROBindData -) - -var positionalArgs = [...]string{ - Tmpfs: "--tmpfs", - Symlink: "--symlink", - - Bind: "--bind", - BindTry: "--bind-try", - DevBind: "--dev-bind", - DevBindTry: "--dev-bind-try", - ROBind: "--ro-bind", - ROBindTry: "--ro-bind-try", - - Chmod: "--chmod", - Dir: "--dir", - RemountRO: "--remount-ro", - Procfs: "--proc", - DevTmpfs: "--dev", - Mqueue: "--mqueue", - - Perms: "--perms", - Size: "--size", - - OverlaySrc: "--overlay-src", - Overlay: "--overlay", - TmpOverlay: "--tmp-overlay", - ROOverlay: "--ro-overlay", - - SyncFd: "--sync-fd", - Seccomp: "--seccomp", - - File: "--file", - BindData: "--bind-data", - ROBindData: "--ro-bind-data", -} - -type PermConfig[T FSBuilder] struct { - // set permissions of next argument - // (--perms OCTAL) - Mode *os.FileMode `json:"mode,omitempty"` - // path to get the new permission - // (--bind-data, --file, etc.) - Inner T `json:"path"` -} - -func (p *PermConfig[T]) Path() string { return p.Inner.Path() } - -func (p *PermConfig[T]) Len() int { - if p.Mode != nil { - return p.Inner.Len() + 2 - } else { - return p.Inner.Len() - } -} - -func (p *PermConfig[T]) Append(args *[]string) { - if p.Mode != nil { - *args = append(*args, Perms.String(), strconv.FormatInt(int64(*p.Mode), 8)) - } - p.Inner.Append(args) -} - -type TmpfsConfig struct { - // set size of tmpfs - // (--size BYTES) - Size int `json:"size,omitempty"` - // mount point of new tmpfs - // (--tmpfs DEST) - Dir string `json:"dir"` -} - -func (t *TmpfsConfig) Path() string { return t.Dir } - -func (t *TmpfsConfig) Len() int { - if t.Size > 0 { - return 4 - } else { - return 2 - } -} - -func (t *TmpfsConfig) Append(args *[]string) { - if t.Size > 0 { - *args = append(*args, Size.String(), strconv.Itoa(t.Size)) - } - *args = append(*args, Tmpfs.String(), t.Dir) -} - -type OverlayConfig struct { - /* - read files from SRC in the following overlay - (--overlay-src SRC) - */ - Src []string `json:"src,omitempty"` - - /* - mount overlayfs on DEST, with RWSRC as the host path for writes and - WORKDIR an empty directory on the same filesystem as RWSRC - (--overlay RWSRC WORKDIR DEST) - - if nil, mount overlayfs on DEST, with writes going to an invisible tmpfs - (--tmp-overlay DEST) - - if either strings are empty, mount overlayfs read-only on DEST - (--ro-overlay DEST) - */ - Persist *[2]string `json:"persist,omitempty"` - - /* - --overlay RWSRC WORKDIR DEST - - --tmp-overlay DEST - - --ro-overlay DEST - */ - Dest string `json:"dest"` -} - -func (o *OverlayConfig) Path() string { return o.Dest } - -func (o *OverlayConfig) Len() int { - // (--tmp-overlay DEST) or (--ro-overlay DEST) - p := 2 - // (--overlay RWSRC WORKDIR DEST) - if o.Persist != nil && o.Persist[0] != "" && o.Persist[1] != "" { - p = 4 - } - - return p + len(o.Src)*2 -} - -func (o *OverlayConfig) Append(args *[]string) { - // --overlay-src SRC - for _, src := range o.Src { - *args = append(*args, OverlaySrc.String(), src) - } - - if o.Persist != nil { - if o.Persist[0] != "" && o.Persist[1] != "" { - // --overlay RWSRC WORKDIR - *args = append(*args, Overlay.String(), o.Persist[0], o.Persist[1]) - } else { - // --ro-overlay - *args = append(*args, ROOverlay.String()) - } - } else { - // --tmp-overlay - *args = append(*args, TmpOverlay.String()) - } - - // DEST - *args = append(*args, o.Dest) -} - -type SymlinkConfig [2]string - -func (s SymlinkConfig) Path() string { return s[1] } -func (s SymlinkConfig) Len() int { return 3 } -func (s SymlinkConfig) Append(args *[]string) { *args = append(*args, Symlink.String(), s[0], s[1]) } - -type ChmodConfig map[string]os.FileMode - -func (c ChmodConfig) Len() int { return len(c) } -func (c ChmodConfig) Append(args *[]string) { - for path, mode := range c { - *args = append(*args, Chmod.String(), strconv.FormatInt(int64(mode), 8), path) - } -} - -const ( - DataWrite = iota - DataBind - DataROBind -) - -type DataConfig struct { - Dest string `json:"dest"` - Data []byte `json:"data,omitempty"` - Type int `json:"type"` - proc.File -} - -func (d *DataConfig) Path() string { return d.Dest } -func (d *DataConfig) Len() int { - if d == nil || d.Data == nil { - return 0 - } - return 3 -} -func (d *DataConfig) Init(fd uintptr, v **os.File) uintptr { - if d.File != nil { - panic("file initialised twice") - } - d.File = proc.NewWriterTo(d) - return d.File.Init(fd, v) -} -func (d *DataConfig) WriteTo(w io.Writer) (int64, error) { - n, err := w.Write(d.Data) - return int64(n), err -} -func (d *DataConfig) Append(args *[]string) { - if d == nil || d.Data == nil { - return - } - var a PositionalArg - switch d.Type { - case DataWrite: - a = File - case DataBind: - a = BindData - case DataROBind: - a = ROBindData - default: - panic(fmt.Sprintf("invalid type %d", a)) - } - - *args = append(*args, a.String(), strconv.Itoa(int(d.Fd())), d.Dest) -} |
