Fix bugs and add security features to redbean

- Fix a regression with the previous change that broke redbean
- Add chroot(), resource limit, seccomp, and other stuff to redbean
- Write lots and lots of documentation
- Iron out more system call issues
This commit is contained in:
Justine Tunney 2022-04-18 00:01:26 -07:00
parent f1dfa4bdfa
commit 7166679620
182 changed files with 1855 additions and 918 deletions

View file

@ -16,6 +16,7 @@
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
*/
#include "libc/calls/issandboxed.h"
#include "libc/dce.h"
#include "libc/log/libfatal.internal.h"
#include "libc/log/log.h"
@ -35,24 +36,20 @@ noasan noubsan int IsDebuggerPresent(bool force) {
int fd, res;
ssize_t got;
char *p, buf[1024];
if (!force) {
if (IsGenuineCosmo()) return 0;
if (getenv("HEISENDEBUG")) return 0;
}
if (IsWindows()) {
return NtGetPeb()->BeingDebugged; /* needs noasan */
} else {
res = 0;
if ((fd = __sysv_open("/proc/self/status", O_RDONLY, 0)) >= 0) {
if ((got = __sysv_read(fd, buf, sizeof(buf) - 1)) > 0) {
buf[got] = '\0';
if ((p = __strstr(buf, kPid))) {
p += sizeof(kPid) - 1;
res = __atoul(p);
}
if (!force && IsGenuineCosmo()) return 0;
if (!force && getenv("HEISENDEBUG")) return 0;
if (IsWindows()) return NtGetPeb()->BeingDebugged; /* needs noasan */
if (__issandboxed) return false;
res = 0;
if ((fd = __sysv_open("/proc/self/status", O_RDONLY, 0)) >= 0) {
if ((got = __sysv_read(fd, buf, sizeof(buf) - 1)) > 0) {
buf[got] = '\0';
if ((p = __strstr(buf, kPid))) {
p += sizeof(kPid) - 1;
res = __atoul(p);
}
__sysv_close(fd);
}
return res;
__sysv_close(fd);
}
return res;
}