socsvn commit: r256906 - soc2013/dpl/head/lib/libzcap
dpl at FreeBSD.org
dpl at FreeBSD.org
Wed Sep 4 18:59:40 UTC 2013
Author: dpl
Date: Wed Sep 4 18:59:39 2013
New Revision: 256906
URL: http://svnweb.FreeBSD.org/socsvn/?view=rev&rev=256906
Log:
mini-update.
Modified:
soc2013/dpl/head/lib/libzcap/capsicum.c
soc2013/dpl/head/lib/libzcap/capsicum.h
Modified: soc2013/dpl/head/lib/libzcap/capsicum.c
==============================================================================
--- soc2013/dpl/head/lib/libzcap/capsicum.c Wed Sep 4 18:28:03 2013 (r256905)
+++ soc2013/dpl/head/lib/libzcap/capsicum.c Wed Sep 4 18:59:39 2013 (r256906)
@@ -13,76 +13,20 @@
#include <stdio.h>
#include <err.h>
-external struct sandbox;
-external struct slisthead sandboxes;
+extern struct sandbox;
+extern struct slisthead sandboxes;
-int startChild(void);
+struct sandbox * startSandbox(void *data);
+int stopSandbox(struct sandbox *sandbox);
+void startNullSandbox(void);
+struct sandbox * findSandbox(void *ptr);
+struct sandbox *startChild(void *data);
void killChild(void);
void suicide(int signal);
-nvlist_t * sendCommand(nvlist_t *nvl);
+nvlist_t * sendCommand(nvlist_t *nvl, int socket);
bool slist_initiated = 0;
-nvlist_t *
-sendCommand(nvlist_t *nvl, int socket)
-{
- nvlist_t *new;
- if( nvlist_send(socket, nvl) != 0 )
- err(1, "zcaplib: nvlist_send() Went wrong");
- if ((new = nvlist_recv(socket)) == NULL)
- err(1, "nvlist_recv(): nvlist_t is NULL");
- return (new);
-}
-
-void killChild(void) {
- kill(pid, SIGKILL);
-}
-void suicide(int signal) {
- kill(getpid(), SIGKILL);
-}
-
-void
-startChild(void *data)
-{
- int procd, sv[2];
- struct sandbox *newsandbox;
-
- if ((newsandbox = malloc(sizeof (struct sandbox)) == NULL)
- err(1, "Couldn't allocate memory for sandboxes");
-
- sv[0] = sv[1] = 0;
- if (socketpair(PF_LOCAL, SOCK_STREAM, 0, sv) < 0 )
- perror("zcaplib: socketpair()");
-
- procd = pdfork();
- if (pid == 0 ){
- if (cap_rights_limit(STDIN_FILENO, CAP_READ) < 0)
- err(1, "Couldn't limit rights");
- if (cap_rights_limit(STDOUT_FILENO, CAP_WRITE|CAP_FSTAT) < 0)
- err(1, "Couldn't limit rights");
- if (cap_rights_limit(STDERR_FILENO, CAP_WRITE) < 0)
- err(1, "Couldn't limit rights");
- dup2(sv[0], 3);
- if (cap_rights_limit(3, CAP_WRITE|CAP_READ|CAP_POLL_EVENT) < 0)
- err(1, "Couldn't limit rights");
- closefrom(4);
-
- /* execl() zlibworker */
- if ( execl("/usr/libexec/zlibworker", "zlibworker", NULL) < 0) {
- err(1, "Couldn't find zlibworker.");
- }
- exit(0);
- } else if (pid == -1) {
- err(1, "Couldn't fork");
- } else {
- close(sv[1]);
- signal(SIGCHLD, suicide);
- atexit(killChild);
- sandbox->dataptr = data;
- sandbox->pd = procd;
- sandbox->socket = sv[0];
- }
-}
/*
* This function should be called only by:
@@ -104,22 +48,6 @@
return (newsandbox);
}
-void
-startNullSandbox(void)
-{
- if (!slist_initiated) {
- SLIST_INIT(&sandboxes);
-
- /* Here we add a sandbox used for non-structure related stuff */
- /* This will be the first sandbox always */
- if (SLIST_EMPTY(&sandboxes)) {
- newsandbox = startChild(newsandbox, NULL);
- SLIST_INSERT_HEAD(&sandboxes, newsandbox, entries);
- }
- }
- slist_initiated = 1;
-}
-
/*
* Kills the sandbox, and deletes the associated
* struct sandbox. Should be called by: gzclose,
@@ -140,19 +68,33 @@
free(sandbox);
}
+/* Starts the default sandbox. */
+void
+startNullSandbox(void)
+{
+ if (!slist_initiated) {
+ sandboxes = SLIST_HEAD_INITIALIZER(head);
+ SLIST_INIT(&sandboxes);
+ /* Here we add a sandbox used for non-structure related stuff */
+ /* This will be the first sandbox always */
+ if (SLIST_EMPTY(&sandboxes)) {
+ newsandbox = startChild(newsandbox, NULL);
+ SLIST_INSERT_HEAD(&sandboxes, newsandbox, entries);
+ }
+ }
+ slist_initiated = 1;
+}
+
/*
* Finds the struct sandbox for
* a pointer to the data structure
* the sandbox is related to.
- * Returns NULL if not found.
*/
struct sandbox *
-findsandbox(void *ptr)
+findSandbox(void *ptr)
{
struct sandbox *sandbox;
- sandbox = NULL;
-
if (ptr == NULL)
return (SLIST_FIRST(&sandboxes));
@@ -162,4 +104,65 @@
/* Not found */
return (NULL);
-}
\ No newline at end of file
+}
+
+struct sandbox *
+startChild(void *data)
+{
+ int procd, sv[2];
+ struct sandbox *newsandbox;
+
+ if ((newsandbox = malloc(sizeof (struct sandbox)) == NULL)
+ err(1, "Couldn't allocate memory for sandboxes");
+
+ sv[0] = sv[1] = 0;
+ if (socketpair(PF_LOCAL, SOCK_STREAM, 0, sv) < 0 )
+ perror("zcaplib: socketpair()");
+
+ procd = pdfork();
+ if (pid == 0 ){
+ if (cap_rights_limit(STDIN_FILENO, CAP_READ) < 0)
+ err(1, "Couldn't limit rights");
+ if (cap_rights_limit(STDOUT_FILENO, CAP_WRITE|CAP_FSTAT) < 0)
+ err(1, "Couldn't limit rights");
+ if (cap_rights_limit(STDERR_FILENO, CAP_WRITE) < 0)
+ err(1, "Couldn't limit rights");
+ dup2(sv[0], 3);
+ if (cap_rights_limit(3, CAP_WRITE|CAP_READ|CAP_POLL_EVENT) < 0)
+ err(1, "Couldn't limit rights");
+ closefrom(4);
+
+ /* execl() zlibworker */
+ if ( execl("/usr/libexec/zlibworker", "zlibworker", NULL) < 0) {
+ err(1, "Couldn't find zlibworker.");
+ }
+ exit(0);
+ } else if (pid == -1) {
+ err(1, "Couldn't fork");
+ } else {
+ close(sv[1]);
+ signal(SIGCHLD, suicide);
+ atexit(killChild);
+ sandbox->dataptr = data;
+ sandbox->pd = procd;
+ sandbox->socket = sv[0];
+ }
+}
+
+void killChild(void) {
+ kill(pid, SIGKILL);
+}
+void suicide(int signal) {
+ kill(getpid(), SIGKILL);
+}
+
+nvlist_t *
+sendCommand(nvlist_t *nvl, int socket)
+{
+ nvlist_t *new;
+ if( nvlist_send(socket, nvl) != 0 )
+ err(1, "zcaplib: nvlist_send() Went wrong");
+ if ((new = nvlist_recv(socket)) == NULL)
+ err(1, "nvlist_recv(): nvlist_t is NULL");
+ return (new);
+}
Modified: soc2013/dpl/head/lib/libzcap/capsicum.h
==============================================================================
--- soc2013/dpl/head/lib/libzcap/capsicum.h Wed Sep 4 18:28:03 2013 (r256905)
+++ soc2013/dpl/head/lib/libzcap/capsicum.h Wed Sep 4 18:59:39 2013 (r256906)
@@ -18,16 +18,18 @@
#define MAXLEN (5*1024)
-extern int pid;
-extern int sv[2];
-extern struct sandbox * sandboxes;
-
-extern int startChild(void);
-extern void killChild(void);
-extern nvlist_t * sendCommand(nvlist_t *nvl);
+struct sandbox * startSandbox(void *data);
+int stopSandbox(struct sandbox *sandbox);
+void startNullSandbox(void);
+struct sandbox * findSandbox(void *ptr);
+struct sandbox *startChild(void *data);
+void killChild(void);
+void suicide(int signal);
+nvlist_t * sendCommand(nvlist_t *nvl, int socket);
/* head of singly-linked list. */
-SLIST_HEAD(slisthead, sandbox) sandboxes = SLIST_HEAD_INITIALIZER(head);
+struct slisthead sandboxes;
+SLIST_HEAD(slisthead, sandbox) sandboxes;
/*
* This structure holds a relation of structs of data structs,
@@ -38,4 +40,4 @@
int pd; /* Process descriptor */
int socket; /* Socket we have to pass the data through */
SLIST_ENTRY(entry) entries; /* Singly-linked list. */
-}
+};
More information about the svn-soc-all
mailing list