From 9ce4706a0766880c072cccd2643d66f614a6a16b Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 17 Mar 2025 02:48:32 +0900 Subject: sandbox: move params setup functions Signed-off-by: Ophestra --- helper/proc/fd.go | 48 ------------------------------------------- internal/app/init0/main.go | 7 +++---- internal/app/shim/main.go | 9 ++++---- internal/app/shim/manager.go | 3 ++- internal/sandbox/container.go | 3 +-- internal/sandbox/init.go | 7 +++---- internal/sandbox/params.go | 47 ++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 60 insertions(+), 64 deletions(-) delete mode 100644 helper/proc/fd.go create mode 100644 internal/sandbox/params.go diff --git a/helper/proc/fd.go b/helper/proc/fd.go deleted file mode 100644 index abf8f36a..00000000 --- a/helper/proc/fd.go +++ /dev/null @@ -1,48 +0,0 @@ -package proc - -import ( - "encoding/gob" - "errors" - "os" - "strconv" -) - -var ( - ErrNotSet = errors.New("environment variable not set") - ErrInvalid = errors.New("bad file descriptor") -) - -// Setup appends the read end of a pipe for payload transmission and returns its fd. -func Setup(extraFiles *[]*os.File) (int, *gob.Encoder, error) { - if r, w, err := os.Pipe(); err != nil { - return -1, nil, err - } else { - fd := 3 + len(*extraFiles) - *extraFiles = append(*extraFiles, r) - return fd, gob.NewEncoder(w), nil - } -} - -// Receive retrieves payload pipe fd from the environment, -// receives its payload and returns the Close method of the pipe. -func Receive(key string, e any, v **os.File) (func() error, error) { - var setup *os.File - - if s, ok := os.LookupEnv(key); !ok { - return nil, ErrNotSet - } else { - if fd, err := strconv.Atoi(s); err != nil { - return nil, err - } else { - setup = os.NewFile(uintptr(fd), "setup") - if setup == nil { - return nil, ErrInvalid - } - if v != nil { - *v = setup - } - } - } - - return setup.Close, gob.NewDecoder(setup).Decode(e) -} diff --git a/internal/app/init0/main.go b/internal/app/init0/main.go index 83033134..46ce4490 100644 --- a/internal/app/init0/main.go +++ b/internal/app/init0/main.go @@ -9,7 +9,6 @@ import ( "syscall" "time" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" "git.gensokyo.uk/security/fortify/internal/sandbox" @@ -42,11 +41,11 @@ func Main() { payload Payload closeSetup func() error ) - if f, err := proc.Receive(Env, &payload, nil); err != nil { - if errors.Is(err, proc.ErrInvalid) { + if f, err := sandbox.Receive(Env, &payload, nil); err != nil { + if errors.Is(err, sandbox.ErrInvalid) { log.Fatal("invalid config descriptor") } - if errors.Is(err, proc.ErrNotSet) { + if errors.Is(err, sandbox.ErrNotSet) { log.Fatal("FORTIFY_INIT not set") } diff --git a/internal/app/shim/main.go b/internal/app/shim/main.go index effa6b84..94501497 100644 --- a/internal/app/shim/main.go +++ b/internal/app/shim/main.go @@ -13,7 +13,6 @@ import ( "git.gensokyo.uk/security/fortify/fst" "git.gensokyo.uk/security/fortify/helper" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/app/init0" "git.gensokyo.uk/security/fortify/internal/fmsg" @@ -38,11 +37,11 @@ func Main() { payload Payload closeSetup func() error ) - if f, err := proc.Receive(Env, &payload, nil); err != nil { - if errors.Is(err, proc.ErrInvalid) { + if f, err := sandbox.Receive(Env, &payload, nil); err != nil { + if errors.Is(err, sandbox.ErrInvalid) { log.Fatal("invalid config descriptor") } - if errors.Is(err, proc.ErrNotSet) { + if errors.Is(err, sandbox.ErrNotSet) { log.Fatal("FORTIFY_SHIM not set") } @@ -108,7 +107,7 @@ func Main() { var extraFiles []*os.File // serve setup payload - if fd, encoder, err := proc.Setup(&extraFiles); err != nil { + if fd, encoder, err := sandbox.Setup(&extraFiles); err != nil { log.Fatalf("cannot pipe: %v", err) } else { conf.SetEnv[init0.Env] = strconv.Itoa(fd) diff --git a/internal/app/shim/manager.go b/internal/app/shim/manager.go index bb3948fd..4b5432b8 100644 --- a/internal/app/shim/manager.go +++ b/internal/app/shim/manager.go @@ -13,6 +13,7 @@ import ( "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" + "git.gensokyo.uk/security/fortify/internal/sandbox" ) // used by the parent process @@ -56,7 +57,7 @@ func (s *Shim) Start( s.cmd = exec.Command(fsuPath) // pass shim setup pipe - if fd, e, err := proc.Setup(&s.cmd.ExtraFiles); err != nil { + if fd, e, err := sandbox.Setup(&s.cmd.ExtraFiles); err != nil { return nil, fmsg.WrapErrorSuffix(err, "cannot create shim setup pipe:") } else { diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go index f243ffd9..afbcc4fd 100644 --- a/internal/sandbox/container.go +++ b/internal/sandbox/container.go @@ -13,7 +13,6 @@ import ( "syscall" "time" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/seccomp" ) @@ -163,7 +162,7 @@ func (p *Container) Start() error { } // place setup pipe before user supplied extra files, this is later restored by init - if fd, e, err := proc.Setup(&p.cmd.ExtraFiles); err != nil { + if fd, e, err := Setup(&p.cmd.ExtraFiles); err != nil { return wrapErrSuffix(err, "cannot create shim setup pipe:") } else { diff --git a/internal/sandbox/init.go b/internal/sandbox/init.go index 058fe9a2..a6fac1a3 100644 --- a/internal/sandbox/init.go +++ b/internal/sandbox/init.go @@ -13,7 +13,6 @@ import ( "syscall" "time" - "git.gensokyo.uk/security/fortify/helper/proc" "git.gensokyo.uk/security/fortify/seccomp" ) @@ -56,11 +55,11 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) { setupFile *os.File offsetSetup int ) - if f, err := proc.Receive(setupEnv, ¶ms, &setupFile); err != nil { - if errors.Is(err, proc.ErrInvalid) { + if f, err := Receive(setupEnv, ¶ms, &setupFile); err != nil { + if errors.Is(err, ErrInvalid) { log.Fatal("invalid setup descriptor") } - if errors.Is(err, proc.ErrNotSet) { + if errors.Is(err, ErrNotSet) { log.Fatal("FORTIFY_SETUP not set") } diff --git a/internal/sandbox/params.go b/internal/sandbox/params.go new file mode 100644 index 00000000..5b698747 --- /dev/null +++ b/internal/sandbox/params.go @@ -0,0 +1,47 @@ +package sandbox + +import ( + "encoding/gob" + "errors" + "os" + "strconv" +) + +var ( + ErrNotSet = errors.New("environment variable not set") + ErrInvalid = errors.New("bad file descriptor") +) + +// Setup appends the read end of a pipe for setup params transmission and returns its fd. +func Setup(extraFiles *[]*os.File) (int, *gob.Encoder, error) { + if r, w, err := os.Pipe(); err != nil { + return -1, nil, err + } else { + fd := 3 + len(*extraFiles) + *extraFiles = append(*extraFiles, r) + return fd, gob.NewEncoder(w), nil + } +} + +// Receive retrieves setup fd from the environment and receives params. +func Receive(key string, e any, v **os.File) (func() error, error) { + var setup *os.File + + if s, ok := os.LookupEnv(key); !ok { + return nil, ErrNotSet + } else { + if fd, err := strconv.Atoi(s); err != nil { + return nil, err + } else { + setup = os.NewFile(uintptr(fd), "setup") + if setup == nil { + return nil, ErrInvalid + } + if v != nil { + *v = setup + } + } + } + + return setup.Close, gob.NewDecoder(setup).Decode(e) +} -- cgit v1.3.1