Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* tests: handle traps on NULL input for utimensatHEADmasterSam James9 days1-0/+5
| | | | | | | | | When building with -fisolate-erroneous-paths-attribute, GCC turns the call to utimensat w/ a NULL arg into a trap because of its nonnull attribute(s). Workaround that in the test. Bug: https://bugs.gentoo.org/549108 Signed-off-by: Sam James <sam@gentoo.org>
* NOCOLOR -> NO_COLORSam James10 days6-10/+10
| | | | | | | | See https://no-color.org/. We already switched Portage and gentoolkit. Bug: https://bugs.gentoo.org/898224 Bug: https://bugs.gentoo.org/902551 Signed-off-by: Sam James <sam@gentoo.org>
* Update ax_check_compile_flag.m4Mike Gilbert2024-11-041-3/+13
| | | | Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* Fix behavior of utimensat(..., AT_EMPTY_PATH)Mike Gilbert2024-11-041-1/+1
| | | | | Bug: https://bugs.gentoo.org/935716 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: fix violations where ENOENT is expectedAliaksei Urbanski2024-06-272-3/+7
| | | | | | | | | These changes revert f7d02c04 that aimed to resolve 921581 and fix it in a way that doesn't cause unwanted sandbox violations. Bug: https://bugs.gentoo.org/921581 Signed-off-by: Aliaksei Urbanski <aliaksei.urbanski@gmail.com> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* autogen.sh: sys-devel/autoconf-archive -> dev-build/autoconf-archiveSam James2024-05-041-1/+1
| | | | Signed-off-by: Sam James <sam@gentoo.org>
* Fix SIGSEGV in gtest death tests due to small stackSv. Lockal2024-01-271-5/+29
| | | | | | | | | | | | | | | | | | | | | | | | In https://github.com/google/googletest/blob/v1.14.0/googletest/src/gtest-death-test.cc#L1307 on x86-64 gtest sallocates 8192 bytes for `clone`: ``` static pid_t ExecDeathTestSpawnChild(char* const* argv, int close_fd) { const auto stack_size = static_cast<size_t>(getpagesize() * 2); ... child_pid = clone(&ExecDeathTestChildMain, stack_top, SIGCHLD, &args); ``` After that attempt to call execv is intercepted by libsandbox.so, which allocates 8192 + more bytes multiple times on stack, causing SIGSEGV (instead of expected types of crashes). This PR moves all allocations for related function to heap, so now call path fits `getpagesize() * 2` with large margin. Bug: https://bugs.gentoo.org/923013 Closes: https://github.com/gentoo/sandbox/pull/26 Signed-off-by: Sv. Lockal <lockalsash@gmail.com> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: stat the original path for EEXIST hackaroundMike Gilbert2024-01-081-1/+1
| | | | | | | | | | | | Resolves an issue that can occur with paths that contain parent directory references (/../). If part of the path does not exist, the sandboxed program should get ENOENT, not EEXIST. If we use the canonicalized path, intermediate paths will be eliminated and we produce the wrong result. Bug: https://bugs.gentoo.org/921581 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* src: fix -Wold-style-declarationSam James2023-08-081-2/+2
| | | | | | Signed-off-by: Sam James <sam@gentoo.org> Closes: https://github.com/gentoo/sandbox/pull/23 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsbutil: fix -Wold-style-declarationSam James2023-08-081-1/+1
| | | | | Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* egetcwd: fix some edge casesOskari Pirhonen2023-08-081-5/+5
| | | | | | | | | | | | | - Ensure all potentially 21 chars + NUL from "/proc/%i/cwd" fit in its buffer - Use snprintf(3) instead of sprintf(3) to fill in the buffer - readlink(2) does not add a NUL terminator, so ensure it only writes up to the allocated length - 1 - Use a more descriptive name for the return value of readlink(2) Signed-off-by: Oskari Pirhonen <xxc3ncoredxx@gmail.com> Closes: https://github.com/gentoo/sandbox/pull/24 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* resolve_dirfd_path: use separate buffer for readlinkMike Gilbert2023-08-051-4/+5
| | | | | | | | | Fixes a compile warning: ``` warning: passing argument 2 to 'restrict'-qualified parameter aliases with argument 1 [-Wrestrict] ``` Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* erealpath: use separate buffer for readlinkMike Gilbert2023-08-051-2/+4
| | | | | | | | | Fixes a compiler warning: ``` warning: passing argument 2 to 'restrict'-qualified parameter aliases with argument 1 [-Wrestrict] ``` Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* erealpath: leave space for a trailing '\0' in readlink's bufferMike Gilbert2023-08-051-1/+1
| | | | Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* erealpath: drop unused path_max variableMike Gilbert2023-08-051-17/+9
| | | | | | The SB_PATH_MAX macro is always defined, so this variable was pointless. Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* sandbox: do not compare array to NULLgto20232023-08-051-1/+1
| | | | | | | | | | | Fixes a compiler warning: ``` src/environ.c:211:19: warning: the comparison will always evaluate as ‘true’ for the address of ‘work_dir’ will never be NULL [-Waddress] ``` Bug: https://bugs.gentoo.org/906234 Signed-off-by: gto2023 <gto7052@mailbox.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* sandbox: prevent possible use of uninitialized members of sandbox_info structgto20232023-08-051-1/+1
| | | | | Signed-off-by: gto2023 <gto7052@mailbox.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* configure.ac: fix whitespaceSam James2023-08-051-2/+2
| | | | Signed-off-by: Sam James <sam@gentoo.org>
* configure.ac: cleanup error messagesSam James2023-08-051-5/+5
| | | | Signed-off-by: Sam James <sam@gentoo.org>
* Rename multiple personalities featureSam James2023-08-058-44/+44
| | | | | | | | "schizo" isn't a particularly sensitive term, and it's not very clear what it means to non-native English speakers anyway. Name it after what the feature really does: multiple (Linux) personality support using ptrace. Signed-off-by: Sam James <sam@gentoo.org>
* libsbutil: add sbio_faccessat and use it in sb_existsMike Gilbert2023-08-035-0/+15
| | | | | | | | | | | | | sbio_faccessat allows libsbutil to access the unwrapped version of faccessat when called from libsandbox. Using faccessat in place of fstatat seems to give a small boost in performance. Pass AT_EACCESS faccessat to enable a faster path if uid != euid. Bug: https://bugs.gentoo.org/910273 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: skip checking access() without W_OK or R_OK modeMike Gilbert2023-08-031-1/+4
| | | | | | | | If access/faccessat is called with F_OK or X_OK in the mode argument, there is no need to check the path. Bug: https://bugs.gentoo.org/910273 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: always permit access to '/memfd:'Mike Gilbert2023-07-311-0/+6
| | | | | | | | | | | For memfd objects, the kernel populates the target for symlinks under /proc/$PID/fd as "/memfd:name". Said target does not actually exist. It is unfortunate that the kernel includes the leading slash, but we will just have to work around it. Bug: https://bugs.gentoo.org/910561 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* sb_exists: drop use of faccessatMike Gilbert2023-07-171-10/+0
| | | | | | | | faccessat appears to perform quite poorly under certain conditions. Go back to using fstatat until this can be debugged. Bug: https://bugs.gentoo.org/910273 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox/trace: cast NT_ARM_SYSTEM_CALL to avoid warningsMike Gilbert2023-07-101-2/+2
| | | | | Bug: https://bugs.gentoo.org/910195 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox/trace: fix syscall cancellation on arm64Mike Gilbert2023-07-071-1/+20
| | | | | | | | arm64 has a dedicated regset to manipulate the system call number. See kernel commit 766a85d7bc5d7f1ddd6de28bdb844eae45ec63b0. Bug: https://bugs.gentoo.org/909416 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* tests: use explicit adddeny() calls in fchmod and fchown tests.Michael Orlitzky2023-07-012-2/+10
| | | | | | | | | | | | | | When running the test suite under portage, the entire build directory will be writable because portage adds PORTAGE_TMPDIR to SANDBOX_WRITE (thanks floppym). This breaks the tests for these two wrappers, since they expect to fail when trying to write above $PWD. To avoid that, we create a new file to call fchown/fchmod on, and then explicitly deny access to it. Closes: https://bugs.gentoo.org/909445 Signed-off-by: Michael Orlitzky <mjo@gentoo.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* CI: clean up glibc jobMike Gilbert2023-06-231-29/+3
| | | | Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* CI: add musl configMike Gilbert2023-06-231-1/+20
| | | | Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* configure: update libc grep expressionMike Gilbert2023-06-231-1/+1
| | | | | | On Alpine, libc's SONAME is 'libc.musl-x86_64.so.1'. Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: wrap musl time64 functionsMike Gilbert2023-06-225-0/+8
| | | | | | | | musl uses different names from glibc for the time64 symbols. Add them to symbols.h, and use symlinks for the wrapper-func files. Bug: https://bugs.gentoo.org/908970 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* tests: add more tests to make sure fchown/fchmod are handled correctly.Michael Orlitzky2023-06-224-0/+24
| | | | | | Closes: https://bugs.gentoo.org/599706 Signed-off-by: Michael Orlitzky <mjo@gentoo.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* tests: add test case for fchown/fchmod with O_RDONLY.Michael Orlitzky2023-06-227-0/+101
| | | | | | Bug: https://bugs.gentoo.org/599706 Signed-off-by: Michael Orlitzky <mjo@gentoo.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: add support for fchown/fchmod on linuxMichael Orlitzky2023-06-226-0/+61
| | | | | | | | | | | | | | | | | | | | The fchown/fchmod functions use a file descriptor obtained from open(), and the sandbox relies on its open() wrapper for safety. But it turns out that fchown/fchmod can operate on a descriptor opened O_RDONLY, which the open() wrapper is happy to give you. Oops. This is bug 599706. There's no POSIX way to map the descriptor to a path once you've got it, but on linux you can use the magic path "/proc/self/fd/%i" which should be a symlink pointing to the path passed to open(). Once we have that path, we can use the existing "is this path safe" machinery in the sandbox. There is precedent for this approach in sandbox, and the SANDBOX_PROC_SELF_FD macro already exists to indicate that the feature is available. Bug: https://bugs.gentoo.org/599706 Signed-off-by: Michael Orlitzky <mjo@gentoo.org> Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsbutil: add sb_exists functionMike Gilbert2023-06-216-3/+29
| | | | | | | | | This provides a central place to work around a bug on musl where faccessat sets errno to EINVAL when the kernel does not support faccessat2. Bug: https://bugs.gentoo.org/908765 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: add lutimes to symlink_funcMike Gilbert2023-06-123-0/+11
| | | | | | | | lutimes operates on symlinks, so we should not check for access against the symlink target. Bug: https://bugs.gentoo.org/908105 Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* build: Fix libc path configure test for moldJames Le Cuirot2023-02-161-10/+5
| | | | | | | | | | | | | | | bfd, gold, lld, and mold all support `-Wl,--trace`, which has cleaner output than `-Wl,--verbose`. mold doesn't output anything with the latter, so the test didn't support that until now. The only difference between them now is that mold prefixes its output with `trace: ` whereas the others do not. I checked the Solaris linker, but that does not support `-Wl,--trace`. Bug: https://bugs.gentoo.org/830463 Signed-off-by: James Le Cuirot <chewi@gentoo.org> Closes: https://github.com/gentoo/sandbox/pull/5 Signed-off-by: Sam James <sam@gentoo.org>
* CI: add Github ActionsSam James2023-01-061-0/+58
| | | | Signed-off-by: Sam James <sam@gentoo.org>
* Update ax_compiler_vendor.m4Mike Gilbert2022-12-301-5/+7
| | | | Signed-off-by: Mike Gilbert <floppym@gentoo.org>
* libsandbox: reduce & inline the __64_{pre,post}.h headersMike Frysinger2021-11-0514-41/+17
| | | | | | | | | | | | | | | | | | Now that we use 64-bit stat & lstat explicitly everywhere, we don't need these dynamic redirects for 64-bit wrappers. The off_t define is only used by one file anymore too, but we can inline that. That leaves the SB64 define which we use inconsistently in places. In some 64-bit modules that include the 32-bit, we use SB64 to switch between the 64-bit & 32-bit APIs. In other places, the 64-bit file is responsible for redefining the few relevant APIs. Let's switch all the files away from SB64 and to defining the single thing that the 64-bit module needs directly. It's either the same or fewer LOC this way, and doesn't seem any more or less difficult to maintain. The __64_{pre,post}.h & SB64 define weren't easily discoverable. Bug: https://bugs.gentoo.org/583282 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* change FS calls to use 64-bit interfaces explicitlyMike Frysinger2021-11-0514-41/+48
| | | | | | | | | Make sure we use 64-bit FS interfaces when accessing the FS. This is needed not only to stat or open large files, but even files with 64-bit inodes. Bug: https://bugs.gentoo.org/583282 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* build: require at least a C99 compilerMike Frysinger2021-11-051-1/+2
| | | | | | | Realistically we aren't even testing with older than C11 compilers, but one thing at a time. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* build: slim down autoconf-archive macro searchMike Frysinger2021-11-0518-2137/+10
| | | | | | | Only copy in files that define the macros we need and not ones that reference the macros. This avoids copying a lot unused files in. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* build: drop support for ancient C library versionsMike Frysinger2021-11-052-23/+2
| | | | | | We don't need to support glibc versions that predate Linux-2.6. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: move xasprintf helper hereMike Frysinger2021-11-052-9/+16
| | | | | | | | Since this is only used by sandbox, and is not usable by libsandbox, move it out of libsbutil. Leave a note behind for possible future macros too. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* libsandbox/libsbutil: use faccessat for file-existence testsMike Frysinger2021-11-053-27/+5
| | | | | | | | This is faster than using stat since it doesn't have to gather all the metadata, and should avoid LFS issues as a result. Bug: https://bugs.gentoo.org/583282 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Revert "Force sandbox-internal functions to use 64bit file interface"Mike Frysinger2021-11-051-1/+0
| | | | | | | | | | | | | | This reverts commit 19c215f245faf9a453e7171bddccc690c03f7b72. We do not want different LFS interfaces being used in different modules as it makes debugging a nightmare when different functions think basic structures have different layouts & sizes. This also doesn't address the LFS issues sandbox has when code still crashes in libsandbox itself when checking accesses. Bug: https://bugs.gentoo.org/681892 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* bashrc: setup T & HOME variablesMike Frysinger2021-11-051-1/+5
| | | | | | | Current versions of portage don't write these variables to the env file, so manually set them up ourselves. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: move verbose startup info behind debug knobMike Frysinger2021-11-051-8/+8
| | | | | | | These messages aren't super useful to most people, nor are needed on every invocation, so put them behind a debug knob to reduce log spam.x Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* sandbox: add --debug option to control SANDBOX_DEBUGMike Frysinger2021-11-053-2/+15
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>