Merge pull request #156822 from xfix/wrapper-assert-argc-at-least-one
nixos/wrappers: require argc to be at least one
This commit is contained in:
commit
7c035dbb75
|
@ -2,12 +2,12 @@
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
#include <string.h>
|
#include <string.h>
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
|
#include <stdnoreturn.h>
|
||||||
#include <sys/types.h>
|
#include <sys/types.h>
|
||||||
#include <sys/stat.h>
|
#include <sys/stat.h>
|
||||||
#include <sys/xattr.h>
|
#include <sys/xattr.h>
|
||||||
#include <fcntl.h>
|
#include <fcntl.h>
|
||||||
#include <dirent.h>
|
#include <dirent.h>
|
||||||
#include <assert.h>
|
|
||||||
#include <errno.h>
|
#include <errno.h>
|
||||||
#include <linux/capability.h>
|
#include <linux/capability.h>
|
||||||
#include <sys/prctl.h>
|
#include <sys/prctl.h>
|
||||||
|
@ -16,10 +16,7 @@
|
||||||
#include <syscall.h>
|
#include <syscall.h>
|
||||||
#include <byteswap.h>
|
#include <byteswap.h>
|
||||||
|
|
||||||
// Make sure assertions are not compiled out, we use them to codify
|
#define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))
|
||||||
// invariants about this program and we want it to fail fast and
|
|
||||||
// loudly if they are violated.
|
|
||||||
#undef NDEBUG
|
|
||||||
|
|
||||||
extern char **environ;
|
extern char **environ;
|
||||||
|
|
||||||
|
@ -38,6 +35,12 @@ static char *wrapper_debug = "WRAPPER_DEBUG";
|
||||||
#define LE32_TO_H(x) (x)
|
#define LE32_TO_H(x) (x)
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
static noreturn void assert_failure(const char *assertion) {
|
||||||
|
fprintf(stderr, "Assertion `%s` in NixOS's wrapper.c failed.\n", assertion);
|
||||||
|
fflush(stderr);
|
||||||
|
abort();
|
||||||
|
}
|
||||||
|
|
||||||
int get_last_cap(unsigned *last_cap) {
|
int get_last_cap(unsigned *last_cap) {
|
||||||
FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r");
|
FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r");
|
||||||
if (file == NULL) {
|
if (file == NULL) {
|
||||||
|
@ -167,6 +170,7 @@ int readlink_malloc(const char *p, char **ret) {
|
||||||
}
|
}
|
||||||
|
|
||||||
int main(int argc, char **argv) {
|
int main(int argc, char **argv) {
|
||||||
|
ASSERT(argc >= 1);
|
||||||
char *self_path = NULL;
|
char *self_path = NULL;
|
||||||
int self_path_size = readlink_malloc("/proc/self/exe", &self_path);
|
int self_path_size = readlink_malloc("/proc/self/exe", &self_path);
|
||||||
if (self_path_size < 0) {
|
if (self_path_size < 0) {
|
||||||
|
@ -181,36 +185,36 @@ int main(int argc, char **argv) {
|
||||||
int len = strlen(wrapper_dir);
|
int len = strlen(wrapper_dir);
|
||||||
if (len > 0 && '/' == wrapper_dir[len - 1])
|
if (len > 0 && '/' == wrapper_dir[len - 1])
|
||||||
--len;
|
--len;
|
||||||
assert(!strncmp(self_path, wrapper_dir, len));
|
ASSERT(!strncmp(self_path, wrapper_dir, len));
|
||||||
assert('/' == wrapper_dir[0]);
|
ASSERT('/' == wrapper_dir[0]);
|
||||||
assert('/' == self_path[len]);
|
ASSERT('/' == self_path[len]);
|
||||||
|
|
||||||
// Make *really* *really* sure that we were executed as
|
// Make *really* *really* sure that we were executed as
|
||||||
// `self_path', and not, say, as some other setuid program. That
|
// `self_path', and not, say, as some other setuid program. That
|
||||||
// is, our effective uid/gid should match the uid/gid of
|
// is, our effective uid/gid should match the uid/gid of
|
||||||
// `self_path'.
|
// `self_path'.
|
||||||
struct stat st;
|
struct stat st;
|
||||||
assert(lstat(self_path, &st) != -1);
|
ASSERT(lstat(self_path, &st) != -1);
|
||||||
|
|
||||||
assert(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));
|
ASSERT(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));
|
||||||
assert(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));
|
ASSERT(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));
|
||||||
|
|
||||||
// And, of course, we shouldn't be writable.
|
// And, of course, we shouldn't be writable.
|
||||||
assert(!(st.st_mode & (S_IWGRP | S_IWOTH)));
|
ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));
|
||||||
|
|
||||||
// Read the path of the real (wrapped) program from <self>.real.
|
// Read the path of the real (wrapped) program from <self>.real.
|
||||||
char real_fn[PATH_MAX + 10];
|
char real_fn[PATH_MAX + 10];
|
||||||
int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);
|
int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);
|
||||||
assert(real_fn_size < sizeof(real_fn));
|
ASSERT(real_fn_size < sizeof(real_fn));
|
||||||
|
|
||||||
int fd_self = open(real_fn, O_RDONLY);
|
int fd_self = open(real_fn, O_RDONLY);
|
||||||
assert(fd_self != -1);
|
ASSERT(fd_self != -1);
|
||||||
|
|
||||||
char source_prog[PATH_MAX];
|
char source_prog[PATH_MAX];
|
||||||
len = read(fd_self, source_prog, PATH_MAX);
|
len = read(fd_self, source_prog, PATH_MAX);
|
||||||
assert(len != -1);
|
ASSERT(len != -1);
|
||||||
assert(len < sizeof(source_prog));
|
ASSERT(len < sizeof(source_prog));
|
||||||
assert(len > 0);
|
ASSERT(len > 0);
|
||||||
source_prog[len] = 0;
|
source_prog[len] = 0;
|
||||||
|
|
||||||
close(fd_self);
|
close(fd_self);
|
||||||
|
|
Loading…
Reference in a new issue