Fix bugs and add security features to redbean

- Fix a regression with the previous change that broke redbean
- Add chroot(), resource limit, seccomp, and other stuff to redbean
- Write lots and lots of documentation
- Iron out more system call issues

test/libc/calls/access_test.c

@@ -29,8 +29,20 @@
 
 char testlib_enable_tmp_setup_teardown;
 
-TEST(access, testNull_returnsEfault) {
+TEST(access, efault) {
   ASSERT_SYS(EFAULT, -1, access(0, F_OK));
+  if (IsWindows() && !IsAsan()) return;  // not possible
+  ASSERT_SYS(EFAULT, -1, access((void *)77, F_OK));
+}
+
+TEST(access, enoent) {
+  ASSERT_SYS(ENOENT, -1, access("doesnotexist", F_OK));
+  ASSERT_SYS(ENOENT, -1, access("o/doesnotexist", F_OK));
+}
+
+TEST(access, enotdir) {
+  ASSERT_SYS(0, 0, touch("o", 0644));
+  ASSERT_SYS(ENOTDIR, -1, access("o/doesnotexist", F_OK));
 }
 
 TEST(access, test) {

test/libc/calls/chdir_test.c

@@ -0,0 +1,51 @@
+/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
+│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8                                :vi│
+╞══════════════════════════════════════════════════════════════════════════════╡
+│ Copyright 2022 Justine Alexandra Roberts Tunney                              │
+│                                                                              │
+│ Permission to use, copy, modify, and/or distribute this software for         │
+│ any purpose with or without fee is hereby granted, provided that the         │
+│ above copyright notice and this permission notice appear in all copies.      │
+│                                                                              │
+│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL                │
+│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED                │
+│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE             │
+│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL         │
+│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR        │
+│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER               │
+│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
+│ PERFORMANCE OF THIS SOFTWARE.                                                │
+╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/calls/calls.h"
+#include "libc/errno.h"
+#include "libc/sysv/consts/o.h"
+#include "libc/testlib/testlib.h"
+
+char testlib_enable_tmp_setup_teardown;
+
+TEST(chdir, efault) {
+  ASSERT_SYS(EFAULT, -1, chdir(0));
+  if (IsWindows() && !IsAsan()) return;  // not possible
+  ASSERT_SYS(EFAULT, -1, chdir((void *)77));
+}
+
+TEST(chdir, enoent) {
+  ASSERT_SYS(ENOENT, -1, chdir("doesnotexist"));
+  ASSERT_SYS(ENOENT, -1, chdir("o/doesnotexist"));
+}
+
+TEST(chdir, enotdir) {
+  ASSERT_SYS(0, 0, touch("o", 0644));
+  ASSERT_SYS(ENOTDIR, -1, chdir("o/doesnotexist"));
+}
+
+TEST(chdir, test) {
+  ASSERT_SYS(0, 0, mkdir("o", 0755));
+  ASSERT_SYS(0, 0, touch("o/file", 0644));
+  ASSERT_SYS(0, 3, open("o/file", O_RDONLY));
+  ASSERT_SYS(0, 0, close(3));
+  ASSERT_SYS(0, 0, chdir("o"));
+  ASSERT_SYS(0, 3, open("file", O_RDONLY));
+  ASSERT_SYS(0, 0, close(3));
+  ASSERT_SYS(ENOENT, -1, open("o/file", O_RDONLY));
+}

test/libc/calls/open_test.c

@@ -16,12 +16,35 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/dce.h"
+#include "libc/errno.h"
 #include "libc/sysv/consts/o.h"
 #include "libc/testlib/testlib.h"
 #include "libc/x/x.h"
 
 char testlib_enable_tmp_setup_teardown;
 
+TEST(open, efault) {
+  ASSERT_SYS(EFAULT, -1, open(0, O_RDONLY));
+  if (IsWindows() && !IsAsan()) return;  // not possible
+  ASSERT_SYS(EFAULT, -1, open((void *)77, O_RDONLY));
+}
+
+TEST(open, enoent) {
+  ASSERT_SYS(ENOENT, -1, open("doesnotexist", O_RDONLY));
+  ASSERT_SYS(ENOENT, -1, open("o/doesnotexist", O_RDONLY));
+}
+
+TEST(open, enotdir) {
+  ASSERT_SYS(0, 0, touch("o", 0644));
+  ASSERT_SYS(ENOTDIR, -1, open("o/doesnotexist", O_RDONLY));
+}
+
+TEST(open, eexist) {
+  ASSERT_SYS(0, 0, touch("exists", 0644));
+  ASSERT_SYS(EEXIST, -1, open("exists", O_WRONLY | O_CREAT | O_EXCL));
+}
+
 TEST(open, testOpenExistingForWriteOnly_seeksToStart) {
   char buf[8] = {0};
   ASSERT_SYS(0, 0, xbarf("hello.txt", "hello", -1));

test/libc/calls/seccomp_test.c

@@ -0,0 +1,72 @@
+/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
+│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8                                :vi│
+╞══════════════════════════════════════════════════════════════════════════════╡
+│ Copyright 2022 Justine Alexandra Roberts Tunney                              │
+│                                                                              │
+│ Permission to use, copy, modify, and/or distribute this software for         │
+│ any purpose with or without fee is hereby granted, provided that the         │
+│ above copyright notice and this permission notice appear in all copies.      │
+│                                                                              │
+│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL                │
+│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED                │
+│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE             │
+│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL         │
+│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR        │
+│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER               │
+│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
+│ PERFORMANCE OF THIS SOFTWARE.                                                │
+╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/calls/calls.h"
+#include "libc/calls/struct/iovec.h"
+#include "libc/intrin/kprintf.h"
+#include "libc/runtime/runtime.h"
+#include "libc/sock/sock.h"
+#include "libc/sysv/consts/o.h"
+#include "libc/sysv/consts/pr.h"
+#include "libc/sysv/consts/seccomp.h"
+#include "libc/sysv/consts/sig.h"
+#include "libc/testlib/testlib.h"
+
+bool __is_linux_2_6_23(void) {
+  if (!IsLinux()) return false;
+  return prctl(PR_GET_SECCOMP) != -1;  // errno should be EINVAL
+}
+
+void SetUp(void) {
+  if (!__is_linux_2_6_23()) {
+    exit(0);
+  }
+}
+
+TEST(seccompStrictMode, evilProcess_getsKill9d) {
+  int ws, pid;
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_STRICT, 0, 0));
+    open("/etc/passwd", O_RDWR);
+    _Exit1(127);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFSIGNALED(ws));
+  EXPECT_EQ(SIGKILL, WTERMSIG(ws));
+}
+
+TEST(seccompStrictMode, goodProcess_isAuthorized) {
+  int ws, pid;
+  int pfds[2];
+  char buf[3] = {0};
+  ASSERT_SYS(0, 0, pipe(pfds));
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_STRICT, 0, 0));
+    write(pfds[1], "hi", 3);
+    _Exit1(0);
+  }
+  EXPECT_SYS(0, 0, close(pfds[1]));
+  EXPECT_SYS(0, 3, read(pfds[0], buf, 3));
+  EXPECT_SYS(0, 0, close(pfds[0]));
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws));
+  EXPECT_EQ(0, WEXITSTATUS(ws));
+  EXPECT_STREQ("hi", buf);
+}

test/libc/calls/setrlimit_test.c

@@ -22,6 +22,7 @@
 #include "libc/calls/sigbits.h"
 #include "libc/calls/struct/rlimit.h"
 #include "libc/calls/struct/sigaction.h"
+#include "libc/dce.h"
 #include "libc/errno.h"
 #include "libc/fmt/fmt.h"
 #include "libc/log/check.h"
@@ -114,25 +115,30 @@ TEST(setrlimit, testFileSizeLimit) {
 }
 
 int SetKernelEnforcedMemoryLimit(size_t n) {
-  struct rlimit rlim = {n, n};
-  if (IsWindows() || IsXnu()) return -1;
-  return setrlimit(!IsOpenbsd() ? RLIMIT_AS : RLIMIT_DATA, &rlim);
+  struct rlimit rlim;
+  getrlimit(RLIMIT_AS, &rlim);
+  rlim.rlim_cur = n;
+  return setrlimit(RLIMIT_AS, &rlim);
 }
 
 TEST(setrlimit, testMemoryLimit) {
   char *p;
+  bool gotsome;
   int i, wstatus;
-  if (IsAsan()) return;    /* b/c we use sys_mmap */
-  if (IsXnu()) return;     /* doesn't work on darwin */
-  if (IsWindows()) return; /* of course it doesn't work on windows */
+  if (IsAsan()) return; /* b/c we use sys_mmap */
   ASSERT_NE(-1, (wstatus = xspawn(0)));
   if (wstatus == -2) {
     ASSERT_EQ(0, SetKernelEnforcedMemoryLimit(MEM));
-    for (i = 0; i < (MEM * 2) / PAGESIZE; ++i) {
-      p = sys_mmap(0, PAGESIZE, PROT_READ | PROT_WRITE,
-                   MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0)
-              .addr;
-      if (p == MAP_FAILED) {
+    for (gotsome = i = 0; i < (MEM * 2) / PAGESIZE; ++i) {
+      p = mmap(0, PAGESIZE, PROT_READ | PROT_WRITE,
+               MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0);
+      if (p != MAP_FAILED) {
+        gotsome = true;
+      } else {
+        if (!IsNetbsd()) {
+          // TODO(jart): what's going on with NetBSD?
+          ASSERT_TRUE(gotsome);
+        }
         ASSERT_EQ(ENOMEM, errno);
         _exit(0);
       }

test/libc/runtime/clone_test.c

@@ -43,6 +43,8 @@ TEST(clone, test) {
   EXPECT_NE(-1, (tid = clone(thread, stack + FRAMESIZE,
                              CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND,
                              0, &ptid, &tls, &ctid)));
-  while ((nowl() - t) < 1 && !x) __builtin_ia32_pause();
+  while ((nowl() - t) < 1 && !x) {
+    __builtin_ia32_pause();
+  }
   ASSERT_EQ(42, x);
 }