PERFORCE change 214152 for review
Brooks Davis
brooks at FreeBSD.org
Mon Jul 9 23:47:01 UTC 2012
http://p4web.freebsd.org/@@214152?ac=10
Change 214152 by brooks at brooks_ecr_current on 2012/07/09 23:46:57
Implement a basic Capsicum sandbox which protects the main process from
a file that exploites the BADMAGIC back door in libvuln_magic and
displays a toxic hazard icon.
Affected files ...
.. //depot/projects/ctsrd/beribsd/src/ctsrd/browser/browser.c#8 edit
Differences ...
==== //depot/projects/ctsrd/beribsd/src/ctsrd/browser/browser.c#8 (text+ko) ====
@@ -31,6 +31,7 @@
#include <sys/types.h>
#include <sys/param.h>
+#include <sys/capability.h>
#include <sys/stat.h>
#include <sys/wait.h>
@@ -44,12 +45,14 @@
#include <fnmatch.h>
#include <libutil.h>
#include <magic.h>
+#define _WITH_DPRINTF
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <time.h>
#include <unistd.h>
+#include <vis.h>
#define BASEIMG "/usr/share/images/browser.png"
#define ICONS "/usr/share/images/icons.png"
@@ -222,12 +225,71 @@
static const char *
get_magic(int fd)
{
+ pid_t pid;
+ ssize_t rlen;
+ char buf[4096], *desc;
+ const char *cdesc;
+ int pfd[2], status;
+ rlen = read(fd, buf, sizeof(buf));
+ if (rlen == -1)
+ return "read-error";
+ if (rlen == 0)
+ return "empty";
+
switch (sbtype) {
case SB_NONE:
- return magic_descriptor(magic, fd);
+ return magic_buffer(magic, buf, rlen);
case SB_CAPSICUM:
- return "devil";
+ if (pipe(pfd) == -1)
+ err(1, "pipe()");
+ pid = fork();
+ if (pid < 0)
+ err(1, "fork()");
+ else if (pid == 0) {
+ close(fd);
+ close(pfd[0]);
+ fb_fini();
+ /* XXX: do more cleanup here */
+ cap_enter();
+
+ cdesc = magic_buffer(magic, buf, rlen);
+ if (cdesc == NULL)
+ dprintf(pfd[1], "badmagic");
+ else
+ dprintf(pfd[1], "%s", cdesc);
+ close(pfd[1]);
+ exit(0);
+ } else {
+ close(pfd[1]);
+ if (wait4(pid, &status, 0, NULL) == -1)
+ err(1, "wait4()");
+ if (WIFEXITED(status) &&
+ WEXITSTATUS(status) != 0) {
+ warnx("child exited with %d",
+ WEXITSTATUS(status));
+ close(pfd[0]);
+ return "badmagic";
+ }
+ else if(WIFSIGNALED(status)) {
+ warn("child killed by signal %d",
+ WTERMSIG(status));
+ close(pfd[0]);
+ return "badmagic";
+ } else {
+ rlen = read(pfd[0], buf, 128);
+ close(pfd[0]);
+ if (rlen == -1)
+ return "read error";
+ if (rlen == 0 || rlen == 1)
+ return "unknown";
+ /* Don't trust the result */
+ desc = buf + rlen;
+ strvisx(desc, buf, rlen - 1, 0);
+ return (desc);
+ }
+ }
+ break;
case SB_CHERI:
return "devil";
default:
More information about the p4-projects
mailing list