mirror of
https://github.com/jart/cosmopolitan.git
synced 2025-07-24 03:20:30 +00:00
Make more fixes and improvements
This change attempts to fix some report build issues. It also builds upon development work described in previous changes.
This commit is contained in:
Justine Tunney
parent
9bfa6ec06e
commit
9d61e23c80
27 changed files with 980 additions and 902 deletions
160
tool/build/jail.c
Normal file
160
tool/build/jail.c
Normal file
|
|
@ -0,0 +1,160 @@
|
|||
/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
|
||||
│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8 :vi│
|
||||
╞══════════════════════════════════════════════════════════════════════════════╡
|
||||
│ Copyright 2022 Justine Alexandra Roberts Tunney │
|
||||
│ │
|
||||
│ Permission to use, copy, modify, and/or distribute this software for │
|
||||
│ any purpose with or without fee is hereby granted, provided that the │
|
||||
│ above copyright notice and this permission notice appear in all copies. │
|
||||
│ │
|
||||
│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL │
|
||||
│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED │
|
||||
│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE │
|
||||
│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL │
|
||||
│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR │
|
||||
│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER │
|
||||
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
|
||||
│ PERFORMANCE OF THIS SOFTWARE. │
|
||||
╚─────────────────────────────────────────────────────────────────────────────*/
|
||||
#include "libc/calls/calls.h"
|
||||
#include "libc/calls/struct/filter.h"
|
||||
#include "libc/calls/struct/sigaction.h"
|
||||
#include "libc/calls/struct/user_regs_struct.h"
|
||||
#include "libc/dce.h"
|
||||
#include "libc/errno.h"
|
||||
#include "libc/intrin/kprintf.h"
|
||||
#include "libc/log/check.h"
|
||||
#include "libc/log/log.h"
|
||||
#include "libc/runtime/runtime.h"
|
||||
#include "libc/sysv/consts/pr.h"
|
||||
#include "libc/sysv/consts/ptrace.h"
|
||||
#include "libc/sysv/consts/sig.h"
|
||||
#include "tool/net/sandbox.h"
|
||||
|
||||
#define __WALL 0x40000000
|
||||
|
||||
static const struct sock_filter kSandboxFilter[] = {
|
||||
_SECCOMP_MACHINE(AUDIT_ARCH_X86_64), //
|
||||
_SECCOMP_LOAD_SYSCALL_NR(), //
|
||||
_SECCOMP_ALLOW_SYSCALL(0x000), // read
|
||||
_SECCOMP_ALLOW_SYSCALL(0x001), // write
|
||||
_SECCOMP_ALLOW_SYSCALL(0x013), // readv
|
||||
_SECCOMP_ALLOW_SYSCALL(0x014), // writev
|
||||
_SECCOMP_ALLOW_SYSCALL(0x005), // fstat
|
||||
_SECCOMP_ALLOW_SYSCALL(0x007), // poll
|
||||
_SECCOMP_ALLOW_SYSCALL(0x008), // lseek
|
||||
_SECCOMP_ALLOW_SYSCALL(0x009), // mmap
|
||||
_SECCOMP_ALLOW_SYSCALL(0x00b), // munmap
|
||||
_SECCOMP_ALLOW_SYSCALL(0x003), // close
|
||||
_SECCOMP_ALLOW_SYSCALL(0x010), // ioctl todo
|
||||
_SECCOMP_ALLOW_SYSCALL(0x016), // pipe
|
||||
_SECCOMP_ALLOW_SYSCALL(0x125), // pipe2
|
||||
_SECCOMP_ALLOW_SYSCALL(0x035), // socketpair
|
||||
_SECCOMP_ALLOW_SYSCALL(0x020), // dup
|
||||
_SECCOMP_ALLOW_SYSCALL(0x021), // dup2
|
||||
_SECCOMP_ALLOW_SYSCALL(0x124), // dup3
|
||||
_SECCOMP_ALLOW_SYSCALL(0x039), // fork
|
||||
_SECCOMP_ALLOW_SYSCALL(0x03a), // vfork
|
||||
_SECCOMP_ALLOW_SYSCALL(0x011), // pread
|
||||
_SECCOMP_ALLOW_SYSCALL(0x012), // pwrite
|
||||
_SECCOMP_ALLOW_SYSCALL(0x127), // preadv
|
||||
_SECCOMP_ALLOW_SYSCALL(0x128), // pwritev
|
||||
_SECCOMP_ALLOW_SYSCALL(0x0d9), // getdents
|
||||
_SECCOMP_ALLOW_SYSCALL(0x028), // sendfile
|
||||
_SECCOMP_ALLOW_SYSCALL(0x02d), // recvfrom
|
||||
_SECCOMP_ALLOW_SYSCALL(0x033), // getsockname
|
||||
_SECCOMP_ALLOW_SYSCALL(0x034), // getpeername
|
||||
_SECCOMP_ALLOW_SYSCALL(0x00f), // rt_sigreturn
|
||||
_SECCOMP_ALLOW_SYSCALL(0x0e4), // clock_gettime
|
||||
_SECCOMP_ALLOW_SYSCALL(0x060), // gettimeofday
|
||||
_SECCOMP_ALLOW_SYSCALL(0x027), // getpid
|
||||
_SECCOMP_ALLOW_SYSCALL(0x03f), // uname
|
||||
_SECCOMP_ALLOW_SYSCALL(0x03c), // exit
|
||||
_SECCOMP_ALLOW_SYSCALL(0x0e7), // exit_group
|
||||
_SECCOMP_TRACE_SYSCALL(0x03e, 0), // kill
|
||||
_SECCOMP_TRACE_SYSCALL(0x101, 0), // openat
|
||||
_SECCOMP_TRACE_SYSCALL(0x106, 0), // newfstatat
|
||||
_SECCOMP_TRACE_SYSCALL(0x029, 0), // socket
|
||||
_SECCOMP_TRACE_SYSCALL(0x031, 0), // bind
|
||||
_SECCOMP_TRACE_SYSCALL(0x02a, 0), // connect
|
||||
_SECCOMP_TRACE_SYSCALL(0x02c, 0), // sendto
|
||||
_SECCOMP_TRACE_SYSCALL(0x036, 0), // setsockopt
|
||||
_SECCOMP_TRACE_SYSCALL(0x048, 0), // fcntl
|
||||
_SECCOMP_TRACE_SYSCALL(0x03b, 0), // execve
|
||||
_SECCOMP_TRACE_SYSCALL(0x102, 0), // mkdirat
|
||||
_SECCOMP_TRACE_SYSCALL(0x104, 0), // chownat
|
||||
_SECCOMP_TRACE_SYSCALL(0x107, 0), // unlinkat
|
||||
_SECCOMP_TRACE_SYSCALL(0x108, 0), // renameat
|
||||
_SECCOMP_TRACE_SYSCALL(0x109, 0), // linkat
|
||||
_SECCOMP_TRACE_SYSCALL(0x10a, 0), // symlinkat
|
||||
_SECCOMP_TRACE_SYSCALL(0x10b, 0), // readlinkat
|
||||
_SECCOMP_TRACE_SYSCALL(0x10c, 0), // fchmodat
|
||||
_SECCOMP_TRACE_SYSCALL(0x10d, 0), // faccessat
|
||||
_SECCOMP_TRACE_SYSCALL(0x0eb, 0), // utimes
|
||||
_SECCOMP_TRACE_SYSCALL(0x105, 0), // futimesat
|
||||
_SECCOMP_TRACE_SYSCALL(0x118, 0), // utimensat
|
||||
_SECCOMP_LOG_AND_RETURN_ERRNO(1), // EPERM
|
||||
};
|
||||
|
||||
static const struct sock_fprog kSandbox = {
|
||||
.len = ARRAYLEN(kSandboxFilter),
|
||||
.filter = kSandboxFilter,
|
||||
};
|
||||
|
||||
int main(int argc, char *argv[]) {
|
||||
struct user_regs_struct regs;
|
||||
int child, evpid, signal, wstatus;
|
||||
|
||||
if (!IsLinux()) {
|
||||
kprintf("error: %s is only supported on linux right now%n", argv[0]);
|
||||
return 1;
|
||||
}
|
||||
if (argc < 2) {
|
||||
kprintf("Usage: %s PROGRAM [ARGS...]%n", argv[0]);
|
||||
return 1;
|
||||
}
|
||||
ShowCrashReports();
|
||||
|
||||
CHECK_NE(-1, (child = fork()));
|
||||
if (!child) {
|
||||
if (ptrace(PTRACE_TRACEME) == -1) _Exit(124);
|
||||
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) _Exit(125);
|
||||
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &kSandbox) == -1) _Exit(126);
|
||||
execvp(argv[1], argv + 1);
|
||||
_Exit(127);
|
||||
}
|
||||
|
||||
sigaction(SIGINT, &(struct sigaction){.sa_handler = SIG_IGN}, 0);
|
||||
sigaction(SIGQUIT, &(struct sigaction){.sa_handler = SIG_IGN}, 0);
|
||||
|
||||
// wait for ptrace(PTRACE_TRACEME) to be called
|
||||
CHECK_EQ(child, waitpid(child, &wstatus, 0));
|
||||
|
||||
// configure linux process tracing
|
||||
CHECK_NE(-1, ptrace(PTRACE_SETOPTIONS, child, 0, PTRACE_O_TRACESECCOMP));
|
||||
|
||||
// continue child process
|
||||
CHECK_NE(-1, ptrace(PTRACE_CONT, child, 0, 0));
|
||||
|
||||
for (;;) {
|
||||
CHECK_NE(-1, (evpid = waitpid(-1, &wstatus, __WALL)));
|
||||
if (WIFSTOPPED(wstatus)) {
|
||||
signal = (wstatus >> 8) & 0xffff;
|
||||
if (signal == SIGTRAP | PTRACE_EVENT_SECCOMP) {
|
||||
// CHECK_NE(-1, ptrace(PTRACE_GETEVENTMSG, evpid, 0, &msg));
|
||||
CHECK_NE(-1, ptrace(PTRACE_GETREGS, evpid, 0, regs));
|
||||
regs.rax = -EPERM;
|
||||
CHECK_NE(-1, ptrace(PTRACE_GETREGS, evpid, 0, regs));
|
||||
ptrace(PTRACE_CONT, evpid, 0, 0);
|
||||
} else {
|
||||
ptrace(PTRACE_CONT, evpid, 0, signal & 127);
|
||||
}
|
||||
} else if (WIFEXITED(wstatus)) {
|
||||
exit(WEXITSTATUS(wstatus));
|
||||
} else {
|
||||
exit(128 + WTERMSIG(wstatus));
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -167,7 +167,7 @@ struct Packages {
|
|||
struct Symbol {
|
||||
uint32_t name; // pkg->strings.p[name]
|
||||
enum SectionKind kind : 8;
|
||||
uint8_t bind : 4;
|
||||
uint8_t bind_ : 4;
|
||||
uint8_t type : 4;
|
||||
uint16_t object; // pkg->objects.p[object]
|
||||
} * p; // persisted as pkg+RVA
|
||||
|
|
@ -342,9 +342,9 @@ void LoadSymbols(struct Package *pkg, uint32_t object) {
|
|||
obj = &pkg->objects.p[object];
|
||||
symbol.object = object;
|
||||
for (i = 0; i < obj->symcount; ++i) {
|
||||
symbol.bind = ELF64_ST_BIND(obj->syms[i].st_info);
|
||||
symbol.bind_ = ELF64_ST_BIND(obj->syms[i].st_info);
|
||||
symbol.type = ELF64_ST_TYPE(obj->syms[i].st_info);
|
||||
if (symbol.bind != STB_LOCAL &&
|
||||
if (symbol.bind_ != STB_LOCAL &&
|
||||
(symbol.type == STT_OBJECT || symbol.type == STT_FUNC ||
|
||||
symbol.type == STT_COMMON || symbol.type == STT_NOTYPE)) {
|
||||
name = GetElfString(obj->elf, obj->size, obj->strs, obj->syms[i].st_name);
|
||||
|
|
@ -448,7 +448,7 @@ void CheckStrictDeps(struct Package *pkg, struct Packages *deps) {
|
|||
struct Symbol *undef;
|
||||
for (i = 0; i < pkg->undefs.i; ++i) {
|
||||
undef = &pkg->undefs.p[i];
|
||||
if (undef->bind == STB_WEAK) continue;
|
||||
if (undef->bind_ == STB_WEAK) continue;
|
||||
if (!FindSymbol(pkg->strings.p + undef->name, pkg, deps, NULL, NULL)) {
|
||||
fprintf(stderr, "%s: %`'s (%s) %s %s\n", "error",
|
||||
pkg->strings.p + undef->name,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue