mirror of
https://github.com/jart/cosmopolitan.git
synced 2025-01-31 19:43:32 +00:00
e81edf7b04
The pledge.com command now supports the new [WIP] unveil() support. For
example, to strongly sandbox our command for listing directories.
o//tool/build/assimilate.com o//examples/ls.com
pledge.com -v /etc -p 'stdio rpath' o//examples/ls.com /etc
This file system sandboxing is going to be perfect for us, because APE
binaries are self-contained static executables that really don't use the
filesystem that much. On the other hand, with non-static executables,
sandboxing is going to be more difficult. For example, here's how to
sandbox the `ls` command on the latest Alpine:
pledge.com -v rx:/lib -v /usr/lib -v /etc -p 'stdio rpath exec' ls /etc
This change fixes the `execpromises` API with pledge().
This change also adds unix.unveil() to redbean.
Fixes #494
86 lines
3.7 KiB
C
86 lines
3.7 KiB
C
/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
|
|
│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8 :vi│
|
|
╞══════════════════════════════════════════════════════════════════════════════╡
|
|
│ Copyright 2020 Justine Alexandra Roberts Tunney │
|
|
│ │
|
|
│ Permission to use, copy, modify, and/or distribute this software for │
|
|
│ any purpose with or without fee is hereby granted, provided that the │
|
|
│ above copyright notice and this permission notice appear in all copies. │
|
|
│ │
|
|
│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL │
|
|
│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED │
|
|
│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE │
|
|
│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL │
|
|
│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR │
|
|
│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER │
|
|
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
|
|
│ PERFORMANCE OF THIS SOFTWARE. │
|
|
╚─────────────────────────────────────────────────────────────────────────────*/
|
|
#include "libc/bits/likely.h"
|
|
#include "libc/bits/weaken.h"
|
|
#include "libc/calls/calls.h"
|
|
#include "libc/calls/strace.internal.h"
|
|
#include "libc/calls/syscall-nt.internal.h"
|
|
#include "libc/calls/syscall-sysv.internal.h"
|
|
#include "libc/dce.h"
|
|
#include "libc/intrin/asan.internal.h"
|
|
#include "libc/intrin/kprintf.h"
|
|
#include "libc/intrin/promises.internal.h"
|
|
#include "libc/log/libfatal.internal.h"
|
|
#include "libc/sysv/consts/o.h"
|
|
#include "libc/sysv/errfuns.h"
|
|
|
|
int sys_pledge_linux(unsigned long);
|
|
|
|
/**
|
|
* Replaces current process with program.
|
|
*
|
|
* @param program will not be PATH searched, see commandv()
|
|
* @param argv[0] is the name of the program to run
|
|
* @param argv[1,n-2] optionally specify program arguments
|
|
* @param argv[n-1] is NULL
|
|
* @param envp[0,n-2] specifies "foo=bar" environment variables
|
|
* @param envp[n-1] is NULL
|
|
* @return doesn't return, or -1 w/ errno
|
|
* @asyncsignalsafe
|
|
* @vforksafe
|
|
*/
|
|
int execve(const char *prog, char *const argv[], char *const envp[]) {
|
|
int rc;
|
|
size_t i;
|
|
if (!prog || !argv || !envp ||
|
|
(IsAsan() &&
|
|
(!__asan_is_valid(prog, 1) || !__asan_is_valid_strlist(argv) ||
|
|
!__asan_is_valid_strlist(envp)))) {
|
|
rc = efault();
|
|
} else {
|
|
#ifdef SYSDEBUG
|
|
if (UNLIKELY(__strace > 0)) {
|
|
kprintf(STRACE_PROLOGUE "execve(%#s, {", prog);
|
|
for (i = 0; argv[i]; ++i) {
|
|
if (i) kprintf(", ");
|
|
kprintf("%#s", argv[i]);
|
|
}
|
|
kprintf("}, {");
|
|
for (i = 0; envp[i]; ++i) {
|
|
if (i) kprintf(", ");
|
|
kprintf("%#s", envp[i]);
|
|
}
|
|
kprintf("})\n");
|
|
}
|
|
#endif
|
|
if (!IsWindows()) {
|
|
rc = 0;
|
|
if (IsLinux() && __execpromises && weaken(sys_pledge_linux)) {
|
|
rc = weaken(sys_pledge_linux)(__execpromises);
|
|
}
|
|
if (!rc) {
|
|
rc = sys_execve(prog, argv, envp);
|
|
}
|
|
} else {
|
|
rc = sys_execve_nt(prog, argv, envp);
|
|
}
|
|
}
|
|
STRACE("execve(%#s) failed %d% m", prog, rc);
|
|
return rc;
|
|
}
|