7cf66bc161
This change introduces the nointernet() function which may be called to prevent a process and its descendants from communicating with publicly routable Internet addresses. GNU Make has been modified to always call this function. In the future Landlock Make will have a way to whitelist subnets to override this behavior, or disable it entirely. Support is available for Linux only. Our firewall does not require root access. Calling nointernet() will return control to the caller inside a new process that has a SECCOMP BPF filter installed, which traps network related system calls. Your original process then becomes a permanent ptrace() supervisor that monitors all processes and threads descending from the returned child. Whenever a networking system call happens the kernel will stop the process and wakes up the monitor, which then peeks into the child memory to read the sockaddr_in to determine if it's ok. The downside to doing this is that there can be only one supervisor at a time using ptrace() on a process. So this firewall won't be enabled if you run make under strace or inside gdb. It also makes testing tricky. |
||
|---|---|---|
| .. | ||
| calls | ||
| consts | ||
| errfuns | ||
| consts.sh | ||
| describeos.greg.c | ||
| errfun.S | ||
| errfuns.h | ||
| errfuns.sh | ||
| errno.c | ||
| errno_location.greg.c | ||
| gen.sh | ||
| macros.internal.h | ||
| README.md | ||
| restorert.S | ||
| strace.greg.c | ||
| syscall.S | ||
| syscalls.sh | ||
| syscount.S | ||
| systemfive.S | ||
| sysv.mk | ||
SYNOPSIS
System Five Import Libraries
OVERVIEW
Bell System Five is the umbrella term we use to describe Linux, FreeBSD, OpenBSD, and Mac OS X which all have nearly-identical application binary interfaces that stood the test of time, having definitions nearly the same as those of AT&T back in the 1980's.
Cosmopolitan aims to help you build apps that can endure over the course of decades, just like these systems have: without needing to lift a finger for maintenance churn, broken builds, broken hearts.
The challenge to System V binary compatibility basically boils down to numbers. All these systems agree on what services are provided, but tend to grant them wildly different numbers.
We address this by putting all the numbers in a couple big shell scripts, ask the GNU Assembler to encode them into binaries using an efficient LEB128 encoding, unpacked by _init(), and ref'd via extern const. It gives us good debuggability, and any costs are gained back by fewer branches in wrapper functions.z