diff options
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/app/init0/main.go | 7 | ||||
| -rw-r--r-- | internal/app/shim/main.go | 9 | ||||
| -rw-r--r-- | internal/app/shim/manager.go | 3 | ||||
| -rw-r--r-- | internal/sandbox/container.go | 3 | ||||
| -rw-r--r-- | internal/sandbox/init.go | 7 | ||||
| -rw-r--r-- | internal/sandbox/params.go | 47 |
6 files changed, 60 insertions, 16 deletions
diff --git a/internal/app/init0/main.go b/internal/app/init0/main.go index 83033134..46ce4490 100644 --- a/internal/app/init0/main.go +++ b/internal/app/init0/main.go @@ -9,7 +9,6 @@ import ( "syscall" "time" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" "git.gensokyo.uk/security/fortify/internal/sandbox" @@ -42,11 +41,11 @@ func Main() { payload Payload closeSetup func() error ) - if f, err := proc.Receive(Env, &payload, nil); err != nil { - if errors.Is(err, proc.ErrInvalid) { + if f, err := sandbox.Receive(Env, &payload, nil); err != nil { + if errors.Is(err, sandbox.ErrInvalid) { log.Fatal("invalid config descriptor") } - if errors.Is(err, proc.ErrNotSet) { + if errors.Is(err, sandbox.ErrNotSet) { log.Fatal("FORTIFY_INIT not set") } diff --git a/internal/app/shim/main.go b/internal/app/shim/main.go index effa6b84..94501497 100644 --- a/internal/app/shim/main.go +++ b/internal/app/shim/main.go @@ -13,7 +13,6 @@ import ( "git.gensokyo.uk/security/fortify/fst" "git.gensokyo.uk/security/fortify/helper" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/app/init0" "git.gensokyo.uk/security/fortify/internal/fmsg" @@ -38,11 +37,11 @@ func Main() { payload Payload closeSetup func() error ) - if f, err := proc.Receive(Env, &payload, nil); err != nil { - if errors.Is(err, proc.ErrInvalid) { + if f, err := sandbox.Receive(Env, &payload, nil); err != nil { + if errors.Is(err, sandbox.ErrInvalid) { log.Fatal("invalid config descriptor") } - if errors.Is(err, proc.ErrNotSet) { + if errors.Is(err, sandbox.ErrNotSet) { log.Fatal("FORTIFY_SHIM not set") } @@ -108,7 +107,7 @@ func Main() { var extraFiles []*os.File // serve setup payload - if fd, encoder, err := proc.Setup(&extraFiles); err != nil { + if fd, encoder, err := sandbox.Setup(&extraFiles); err != nil { log.Fatalf("cannot pipe: %v", err) } else { conf.SetEnv[init0.Env] = strconv.Itoa(fd) diff --git a/internal/app/shim/manager.go b/internal/app/shim/manager.go index bb3948fd..4b5432b8 100644 --- a/internal/app/shim/manager.go +++ b/internal/app/shim/manager.go @@ -13,6 +13,7 @@ import ( "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" + "git.gensokyo.uk/security/fortify/internal/sandbox" ) // used by the parent process @@ -56,7 +57,7 @@ func (s *Shim) Start( s.cmd = exec.Command(fsuPath) // pass shim setup pipe - if fd, e, err := proc.Setup(&s.cmd.ExtraFiles); err != nil { + if fd, e, err := sandbox.Setup(&s.cmd.ExtraFiles); err != nil { return nil, fmsg.WrapErrorSuffix(err, "cannot create shim setup pipe:") } else { diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go index f243ffd9..afbcc4fd 100644 --- a/internal/sandbox/container.go +++ b/internal/sandbox/container.go @@ -13,7 +13,6 @@ import ( "syscall" "time" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/seccomp" ) @@ -163,7 +162,7 @@ func (p *Container) Start() error { } // place setup pipe before user supplied extra files, this is later restored by init - if fd, e, err := proc.Setup(&p.cmd.ExtraFiles); err != nil { + if fd, e, err := Setup(&p.cmd.ExtraFiles); err != nil { return wrapErrSuffix(err, "cannot create shim setup pipe:") } else { diff --git a/internal/sandbox/init.go b/internal/sandbox/init.go index 058fe9a2..a6fac1a3 100644 --- a/internal/sandbox/init.go +++ b/internal/sandbox/init.go @@ -13,7 +13,6 @@ import ( "syscall" "time" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/seccomp" ) @@ -56,11 +55,11 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) { setupFile *os.File offsetSetup int ) - if f, err := proc.Receive(setupEnv, ¶ms, &setupFile); err != nil { - if errors.Is(err, proc.ErrInvalid) { + if f, err := Receive(setupEnv, ¶ms, &setupFile); err != nil { + if errors.Is(err, ErrInvalid) { log.Fatal("invalid setup descriptor") } - if errors.Is(err, proc.ErrNotSet) { + if errors.Is(err, ErrNotSet) { log.Fatal("FORTIFY_SETUP not set") } diff --git a/internal/sandbox/params.go b/internal/sandbox/params.go new file mode 100644 index 00000000..5b698747 --- /dev/null +++ b/internal/sandbox/params.go @@ -0,0 +1,47 @@ +package sandbox + +import ( + "encoding/gob" + "errors" + "os" + "strconv" +) + +var ( + ErrNotSet = errors.New("environment variable not set") + ErrInvalid = errors.New("bad file descriptor") +) + +// Setup appends the read end of a pipe for setup params transmission and returns its fd. +func Setup(extraFiles *[]*os.File) (int, *gob.Encoder, error) { + if r, w, err := os.Pipe(); err != nil { + return -1, nil, err + } else { + fd := 3 + len(*extraFiles) + *extraFiles = append(*extraFiles, r) + return fd, gob.NewEncoder(w), nil + } +} + +// Receive retrieves setup fd from the environment and receives params. +func Receive(key string, e any, v **os.File) (func() error, error) { + var setup *os.File + + if s, ok := os.LookupEnv(key); !ok { + return nil, ErrNotSet + } else { + if fd, err := strconv.Atoi(s); err != nil { + return nil, err + } else { + setup = os.NewFile(uintptr(fd), "setup") + if setup == nil { + return nil, ErrInvalid + } + if v != nil { + *v = setup + } + } + } + + return setup.Close, gob.NewDecoder(setup).Decode(e) +} |