From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id CBC7B1381F3 for ; Sun, 1 Sep 2013 18:02:35 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id A88E1E0FFB; Sun, 1 Sep 2013 18:01:55 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 2405DE0FFB for ; Sun, 1 Sep 2013 18:01:55 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 17C2433EB12 for ; Sun, 1 Sep 2013 18:01:54 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id BFB74E468F for ; Sun, 1 Sep 2013 18:01:52 +0000 (UTC) From: "Jory Pratt" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jory Pratt" Message-ID: <1378058464.1452587eeadccfe5e58bde990d67f6447bbddb33.anarchy@gentoo> Subject: [gentoo-commits] dev/anarchy:master commit in: sys-apps/sandbox/files/, sys-apps/sandbox/ X-VCS-Repository: dev/anarchy X-VCS-Files: sys-apps/sandbox/Manifest sys-apps/sandbox/files/09sandbox sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch sys-apps/sandbox/files/sandbox-2.6-desktop.patch sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch sys-apps/sandbox/files/sandbox-2.6-log-var.patch sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch sys-apps/sandbox/sandbox-2.6-r1.ebuild X-VCS-Directories: sys-apps/sandbox/files/ sys-apps/sandbox/ X-VCS-Committer: anarchy X-VCS-Committer-Name: Jory Pratt X-VCS-Revision: 1452587eeadccfe5e58bde990d67f6447bbddb33 X-VCS-Branch: master Date: Sun, 1 Sep 2013 18:01:52 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: c1933a64-458e-4621-99a8-62b5e2d696e3 X-Archives-Hash: 486e44d2b9f937f1556934a965a47ccb commit: 1452587eeadccfe5e58bde990d67f6447bbddb33 Author: Jory A. Pratt gentoo org> AuthorDate: Sun Sep 1 18:01:04 2013 +0000 Commit: Jory Pratt gentoo org> CommitDate: Sun Sep 1 18:01:04 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=dev/anarchy.git;a=commit;h=1452587e Add pch useflag to sandbox-2.6 for hardened support --- sys-apps/sandbox/Manifest | 10 + sys-apps/sandbox/files/09sandbox | 1 + .../files/sandbox-2.6-check-empty-paths-at.patch | 201 +++++++++++++++++++++ sys-apps/sandbox/files/sandbox-2.6-desktop.patch | 30 +++ .../sandbox/files/sandbox-2.6-hardened-pch.patch | 88 +++++++++ sys-apps/sandbox/files/sandbox-2.6-log-var.patch | 51 ++++++ .../sandbox/files/sandbox-2.6-open-nofollow.patch | 54 ++++++ .../files/sandbox-2.6-static-close-fd.patch | 93 ++++++++++ .../sandbox/files/sandbox-2.6-trace-hppa.patch | 27 +++ sys-apps/sandbox/sandbox-2.6-r1.ebuild | 132 ++++++++++++++ 10 files changed, 687 insertions(+) diff --git a/sys-apps/sandbox/Manifest b/sys-apps/sandbox/Manifest new file mode 100644 index 0000000..33c0d48 --- /dev/null +++ b/sys-apps/sandbox/Manifest @@ -0,0 +1,10 @@ +AUX 09sandbox 37 SHA256 73e9e9d12ba54f1c649813ec86107924050528852c890a8ba1e2853796781bbe SHA512 4e8a9c58debde6480224a45559c5f2db4765213d151e47937f9142f110cac3681bf6402acaf21249a37bb17398e7bc00ae7feee68ecdb5b9363c432eac1b052a WHIRLPOOL 80d55a34d3faf3314f2b9de2200d4b46a800128514be9e30eb59e5f03fb7a0a5197a9e5b5ab33d6b68d35bf83c86a1bd7ba734a33ccd382fe0af3b2c2a11d0bd +AUX sandbox-2.6-check-empty-paths-at.patch 7454 SHA256 a48759a4d3e9a70713473b6fad59bdd750b5cd37e7d632c786205ff20004ae2c SHA512 5eba7915dedf57f44c37881e9c6b48db8733d1493779a33127d08bb9ea77056d788ec9ace72c13eb101f42f01c95309c7cebca6c76212a8c99a8655372c0b7d7 WHIRLPOOL 46eb3a8ef8f22030cd793f3b16adc190b5750019c0df83e161c6918f08555a8ad890c1425b03cbf7e53ebcd34a07a9dd9b594d0c0fe31834656ffce3d58fa284 +AUX sandbox-2.6-desktop.patch 875 SHA256 2eecf67790aeac210f9aa899a86f7664776ed65d9b55159e1b359162dfb9ff74 SHA512 b72ec7f414d19bf513dfb1aea10523fa5dc07a1375d8f08f664d204b64b23c891a79ca14987528c595936f441e1f595b366aabbc57313667c7639d73d089ed9a WHIRLPOOL 7f787b8be9b5712eb2b2a0cd2ff825df1045ebf1cc4e73a50f610e620d30752045690a5c28835465d0ab0c3c4a9eaf8b92a5c123cd741ad69dfedb31aa457fa0 +AUX sandbox-2.6-hardened-pch.patch 2615 SHA256 b24500876b595dcaee46e23dffedc50729ce7af1c7fbfce9cead2cd7a8566ff3 SHA512 439f78d0261996a648053f3b34a9fa34eb0d145862136769a3d448f5314be76046d02a0bcce8fd9cfb59d82fdafe79653c182d104f98c4b51be2c08ce835c8bd WHIRLPOOL 8221650ad746161af71a1b1f5f041a5696b4168d2c1fd3fb1997ba0464ef14de50592d9dd4ecc6981f812ae50e4d2c18c138a40bcdcce1b7f6d5b84f711211a6 +AUX sandbox-2.6-log-var.patch 2039 SHA256 f464a29cdd9de0c510277310f4febc8f96515ff2ff03fc92df1c75b9cbd75619 SHA512 cf6f900b4078eff5870b63b2bc7c81c5b00488e030d7e9ce3007693e9d1339ac6201ddacfaff552c6c9b99b6d32383229133c80190404b7e4fde06ad376b2050 WHIRLPOOL db99737a6567788194f7b37b12b92fcfb4c263df40f40aef9e0a3ef2b6a1523331313b791fffa2b26775b646795364ab1db1711eb4329cda3337df27aebfeffa +AUX sandbox-2.6-open-nofollow.patch 2027 SHA256 c8816ae4e1991f9941abd43ec4bfdbf4e99cf36ee90694f77ab88754c53785ce SHA512 dd5222f32a40def38c9719363a24c48d5b112e3560b44c5f32afc3daa0614fe9bc5cb68ca8ac69032cc8d6299f09b25d4d7c72e16892188b42768ffb28c19f07 WHIRLPOOL 03cb5fb9df04a8d7f92855c292a6c431d01d330fecae198f2c4b95d824454f10ce1ad66db1a9d54d1bef5f74989cf6debb2d98de28ee0c2c6a09c1a0752b5519 +AUX sandbox-2.6-static-close-fd.patch 2945 SHA256 807eb4dc1ba6543c94a90a9a53bb89f42079ea20ed7c196f82d65f280e5de96a SHA512 e2f57c4d80816241f3ba4828c2b27c67d1d604b14b2d575888a978e5c4e8e47e60e3a609d81e59c615bc5b7cee6194cc362e255ae8508f632862a35180c30de8 WHIRLPOOL e08f60227fe954894d3a3a01297e9988f4d7722ea75ffbd2b0f3971d38c8ce00af230fcaecb1f53243a868d54f48bb680e2d547bbeb2ee3e5a11f8942d2084fd +AUX sandbox-2.6-trace-hppa.patch 850 SHA256 20688b2f33162f95af4af5e3c7d3700f2e7776e454b785ac1398f0870f84efa9 SHA512 fb7bf2202f960e952edc1e52fe4b6b085042158223d96b9baa899e871abcdef711ede3122c971120f55f71cc1aad71496a6079222dbaaa6c14b0c6f7ea182454 WHIRLPOOL 80f7fb529b912d19d81b9d71ee4a648db7b217583f2e8f2054cc666839030ea7d0112d69d52a2bf35c4d3549ffbd81dbd0cd39d5993bfabbb43bcb6a4455ade4 +DIST sandbox-2.6.tar.xz 366356 SHA256 95615c5879dfc419713f22ba5506a2802a50ea0ce8a2f57c656354f2e50b1c4d SHA512 32ba7fb675c67fdc8bc52da1db7ed6878e5fea8753accb30d9aca00f708e0dde03287b5962caf5ef031bea6934d6ef3e18404b015c70ebd551d3fd8109ad2371 WHIRLPOOL bab2d015fb0de92a2266408ca7941c8fb66b599179040cfc727ffce5b2424a9722dc55ba89d198e3361044d8cb357314205488d2a980c7b8af063fd8940f0c03 +EBUILD sandbox-2.6-r1.ebuild 3161 SHA256 964556ee3f429cedbd54d4ea9c8c9a468b886199f390b909864e5c35a454bfa4 SHA512 25492535b1a623482c3bec466a3cfc8277ef5f82e3548085dc35a0ac24c5ab5cbedd32ad99c9da07dccd9c116b1c5a532908c5a3023aea6cdfb4dd94ec380c04 WHIRLPOOL 6fb8b8d1426bc8f6e0496bf6afe693bf544fdabacbdefdb310261e0d5dc0ba7548c26a8d26d4c29e8885805ebccc5e9852c3a2573cd6815960aa8f9ee2d21973 diff --git a/sys-apps/sandbox/files/09sandbox b/sys-apps/sandbox/files/09sandbox new file mode 100644 index 0000000..9181eb0 --- /dev/null +++ b/sys-apps/sandbox/files/09sandbox @@ -0,0 +1 @@ +CONFIG_PROTECT_MASK="/etc/sandbox.d" diff --git a/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch b/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch new file mode 100644 index 0000000..e4dc529 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.6-check-empty-paths-at.patch @@ -0,0 +1,201 @@ +From dd726dcc6a95355d0e0cc949018d9c8aefc89a02 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Mon, 24 Dec 2012 19:41:49 -0500 +Subject: [PATCH 1/2] libsandbox: reject "" paths with *at funcs before + checking the dirfd + +When it comes to processing errors, an empty path is checked before +an invalid dirfd. Make sure sandbox matches that behavior for the +random testsuites out there that look for this. + +URL: https://bugs.gentoo.org/346929 +Reported-by: Marien Zwart +Signed-off-by: Mike Frysinger +--- + libsandbox/wrapper-funcs/__pre_check.c | 2 ++ + libsandbox/wrapper-funcs/mkdirat_pre_check.c | 17 +++++------------ + libsandbox/wrapper-funcs/openat_pre_check.c | 15 ++++----------- + libsandbox/wrapper-funcs/unlinkat_pre_check.c | 17 +++++------------ + libsandbox/wrappers.h | 2 ++ + tests/mkdirat-3.sh | 7 +++++++ + tests/mkdirat.at | 1 + + tests/openat-2.sh | 9 +++++++++ + tests/openat.at | 1 + + tests/unlinkat-4.sh | 7 +++++++ + tests/unlinkat.at | 1 + + 11 files changed, 44 insertions(+), 35 deletions(-) + create mode 100755 tests/mkdirat-3.sh + create mode 100755 tests/openat-2.sh + create mode 100755 tests/unlinkat-4.sh + +diff --git a/libsandbox/wrapper-funcs/__pre_check.c b/libsandbox/wrapper-funcs/__pre_check.c +index 2d5711f..28ad91f 100644 +--- a/libsandbox/wrapper-funcs/__pre_check.c ++++ b/libsandbox/wrapper-funcs/__pre_check.c +@@ -20,3 +20,5 @@ + #if SB_NR_UNLINK != SB_NR_UNDEF && SB_NR_UNLINKAT == SB_NR_UNDEF + # include "unlinkat_pre_check.c" + #endif ++ ++#include "__pre_at_check.c" +diff --git a/libsandbox/wrapper-funcs/mkdirat_pre_check.c b/libsandbox/wrapper-funcs/mkdirat_pre_check.c +index 77a65df..0b48d1f 100644 +--- a/libsandbox/wrapper-funcs/mkdirat_pre_check.c ++++ b/libsandbox/wrapper-funcs/mkdirat_pre_check.c +@@ -1,20 +1,13 @@ + bool sb_mkdirat_pre_check(const char *func, const char *pathname, int dirfd) + { + char canonic[SB_PATH_MAX]; +- char dirfd_path[SB_PATH_MAX]; + + save_errno(); + +- /* Expand the dirfd path first */ +- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) { +- case -1: +- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n", +- func, pathname, strerror(errno)); +- return false; +- case 0: +- pathname = dirfd_path; +- break; +- } ++ /* Check incoming args against common *at issues */ ++ char dirfd_path[SB_PATH_MAX]; ++ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path))) ++ return false; + + /* Then break down any relative/symlink paths */ + if (-1 == canonicalize(pathname, canonic)) +diff --git a/libsandbox/wrapper-funcs/openat_pre_check.c b/libsandbox/wrapper-funcs/openat_pre_check.c +index 0127708..5fd5eaa 100644 +--- a/libsandbox/wrapper-funcs/openat_pre_check.c ++++ b/libsandbox/wrapper-funcs/openat_pre_check.c +@@ -15,17 +15,10 @@ bool sb_openat_pre_check(const char *func, const char *pathname, int dirfd, int + + save_errno(); + +- /* Expand the dirfd path first */ ++ /* Check incoming args against common *at issues */ + char dirfd_path[SB_PATH_MAX]; +- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) { +- case -1: +- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n", +- func, pathname, strerror(errno)); +- return false; +- case 0: +- pathname = dirfd_path; +- break; +- } ++ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path))) ++ return false; + + /* Doesn't exist -> skip permission checks */ + struct stat st; +diff --git a/libsandbox/wrapper-funcs/unlinkat_pre_check.c b/libsandbox/wrapper-funcs/unlinkat_pre_check.c +index 9f5e7d7..c004d15 100644 +--- a/libsandbox/wrapper-funcs/unlinkat_pre_check.c ++++ b/libsandbox/wrapper-funcs/unlinkat_pre_check.c +@@ -1,20 +1,13 @@ + bool sb_unlinkat_pre_check(const char *func, const char *pathname, int dirfd) + { + char canonic[SB_PATH_MAX]; +- char dirfd_path[SB_PATH_MAX]; + + save_errno(); + +- /* Expand the dirfd path first */ +- switch (resolve_dirfd_path(dirfd, pathname, dirfd_path, sizeof(dirfd_path))) { +- case -1: +- sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n", +- func, pathname, strerror(errno)); +- return false; +- case 0: +- pathname = dirfd_path; +- break; +- } ++ /* Check incoming args against common *at issues */ ++ char dirfd_path[SB_PATH_MAX]; ++ if (!sb_common_at_pre_check(func, &pathname, dirfd, dirfd_path, sizeof(dirfd_path))) ++ return false; + + /* Then break down any relative/symlink paths */ + if (-1 == canonicalize(pathname, canonic)) +diff --git a/libsandbox/wrappers.h b/libsandbox/wrappers.h +index 5b97787..0aa58bb 100644 +--- a/libsandbox/wrappers.h ++++ b/libsandbox/wrappers.h +@@ -28,5 +28,7 @@ attribute_hidden bool sb_mkdirat_pre_check (const char *func, const char *pathn + attribute_hidden bool sb_openat_pre_check (const char *func, const char *pathname, int dirfd, int flags); + attribute_hidden bool sb_openat64_pre_check (const char *func, const char *pathname, int dirfd, int flags); + attribute_hidden bool sb_unlinkat_pre_check (const char *func, const char *pathname, int dirfd); ++attribute_hidden bool sb_common_at_pre_check(const char *func, const char **pathname, int dirfd, ++ char *dirfd_path, size_t dirfd_path_len); + + #endif +-- +1.8.1.2 + +From 0b8a6d9773cc0e6d86bf1187f46817d5716698fe Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Mon, 24 Dec 2012 19:41:49 -0500 +Subject: [PATCH 2/2] libsandbox: reject "" paths with *at funcs before + checking the dirfd [missing file] + +When it comes to processing errors, an empty path is checked before +an invalid dirfd. Make sure sandbox matches that behavior for the +random testsuites out there that look for this. + +Forgot to `git add` in the previous commit :/. + +URL: https://bugs.gentoo.org/346929 +Reported-by: Marien Zwart +Signed-off-by: Mike Frysinger +--- + libsandbox/wrapper-funcs/__pre_at_check.c | 34 +++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + create mode 100644 libsandbox/wrapper-funcs/__pre_at_check.c + +diff --git a/libsandbox/wrapper-funcs/__pre_at_check.c b/libsandbox/wrapper-funcs/__pre_at_check.c +new file mode 100644 +index 0000000..f72c40c +--- /dev/null ++++ b/libsandbox/wrapper-funcs/__pre_at_check.c +@@ -0,0 +1,34 @@ ++/* ++ * common *at() pre-checks. ++ * ++ * Copyright 1999-2012 Gentoo Foundation ++ * Licensed under the GPL-2 ++ */ ++ ++/* We assume the parent has nested use with save/restore errno */ ++bool sb_common_at_pre_check(const char *func, const char **pathname, int dirfd, ++ char *dirfd_path, size_t dirfd_path_len) ++{ ++ /* the empty path name should fail with ENOENT before any dirfd ++ * checks get a chance to run #346929 ++ */ ++ if (*pathname && *pathname[0] == '\0') { ++ errno = ENOENT; ++ sb_debug_dyn("EARLY FAIL: %s(%s): %s\n", ++ func, *pathname, strerror(errno)); ++ return false; ++ } ++ ++ /* Expand the dirfd path first */ ++ switch (resolve_dirfd_path(dirfd, *pathname, dirfd_path, dirfd_path_len)) { ++ case -1: ++ sb_debug_dyn("EARLY FAIL: %s(%s) @ resolve_dirfd_path: %s\n", ++ func, *pathname, strerror(errno)); ++ return false; ++ case 0: ++ *pathname = dirfd_path; ++ break; ++ } ++ ++ return true; ++} +-- +1.8.1.2 + diff --git a/sys-apps/sandbox/files/sandbox-2.6-desktop.patch b/sys-apps/sandbox/files/sandbox-2.6-desktop.patch new file mode 100644 index 0000000..fbecb07 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.6-desktop.patch @@ -0,0 +1,30 @@ +From 00044ab0c8aaaabf048b5ff0ec2da5b3d7d25752 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Sat, 17 Nov 2012 14:14:26 -0500 +Subject: [PATCH] sandbox.desktop: drop .svg from Icon field +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +URL: http://bugs.gentoo.org/443672 +Reported-by: Petteri Räty +Signed-off-by: Mike Frysinger +--- + data/sandbox.desktop | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/data/sandbox.desktop b/data/sandbox.desktop +index 5b5b576..27a887e 100644 +--- a/data/sandbox.desktop ++++ b/data/sandbox.desktop +@@ -5,6 +5,6 @@ Type=Application + Comment=launch a sandboxed shell ... useful for debugging ebuilds + Exec=sandbox + TryExec=sandbox +-Icon=sandbox.svg ++Icon=sandbox + Categories=Development; + Terminal=true +-- +1.8.1.2 + diff --git a/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch b/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch new file mode 100644 index 0000000..611122a --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.6-hardened-pch.patch @@ -0,0 +1,88 @@ +From: Mike Frysinger +Date: Tue, 28 Aug 2012 16:19:56 +0000 (-0400) +Subject: add a configure option to control pch usage +X-Git-Url: http://git.overlays.gentoo.org/gitweb/?p=proj%2Fsandbox.git;a=commitdiff_plain;h=f2500f5954611d110ac18e9990f42d5a915f8101 + +add a configure option to control pch usage + +Mostly for testing purposes. This also tweaks the dependency to fix a +warning when generating the headers.h.pch in subdirs when the toplevel +headers.h.pch already exists. + +URL: http://bugs.gentoo.org/425524 +Signed-off-by: Mike Frysinger +--- + +diff --git a/Makefile.am b/Makefile.am +index 475c8c0..eb54f42 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -11,9 +11,9 @@ SUBDIRS = \ + src \ + tests + ++noinst_LTLIBRARIES = ++ + SANDBOX_PCH = headers.h.gch libsandbox/headers.h.gch libsbutil/headers.h.gch +-BUILT_SOURCES = $(SANDBOX_PCH) +-noinst_LTLIBRARIES = libpch.la + nodist_libpch_la_SOURCES = $(SANDBOX_PCH) + GCH_CP = ( \ + src=`dirname $@`/.libs/`basename $@`.o; \ +@@ -30,10 +30,23 @@ $(builddir)/libsandbox/headers.h.gch: headers.h + $(builddir)/headers.h.gch: headers.h + $(AM_V_GEN)$(COMPILE) -c -o $@.o $< && $(GCH_CP) + +-libsbutil: libsbutil/headers.h.gch +-libsandbox: libsbutil libsandbox/headers.h.gch +-src: libsbutil headers.h.gch +-tests: src headers.h.gch ++if SB_BUILD_PCH ++BUILT_SOURCES = $(SANDBOX_PCH) ++noinst_LTLIBRARIES += libpch.la ++ ++LIBSBUTIL_PCH = libsbutil/headers.h.gch ++LIBSANDBOX_PCH = libsandbox/headers.h.gch ++TOP_PCH = headers.h.gch ++ ++# Make sure we build the subdirs before the top so they don't ++# try to use the top level headers.h.pch. ++$(TOP_PCH): $(LIBSBUTIL_PCH) $(LIBSANDBOX_PCH) ++endif ++ ++libsbutil: $(LIBSBUTIL_PCH) ++libsandbox: libsbutil $(LIBSANDBOX_PCH) ++src: libsbutil $(TOP_PCH) ++tests: src $(TOP_PCH) + + EXTRA_DIST = headers.h localdecls.h ChangeLog.0 + +diff --git a/configure.ac b/configure.ac +index 661b494..ca0d3ac 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -26,7 +26,7 @@ AC_ISC_POSIX + AC_USE_SYSTEM_EXTENSIONS + + dnl Checks for programs. +-AM_PROG_AR ++#AM_PROG_AR + AC_PROG_INSTALL + AC_PROG_MAKE_SET + AC_PROG_AWK +@@ -38,6 +38,14 @@ LT_INIT([disable-static]) + + AC_PREFIX_DEFAULT([/usr]) + ++dnl allow pch to be controlled ++AC_MSG_CHECKING([whether to use pre-compiled sandbox headers]) ++AC_ARG_ENABLE([pch], ++ [AS_HELP_STRING([--disable-pch],[Disable pre-compiled headers])], ++ [],[enable_pch="yes"]) ++AM_CONDITIONAL([SB_BUILD_PCH], test "$enable_pch" = "yes") ++AC_MSG_RESULT($enable_pch) ++ + dnl multiple personality support (x86 & x86_64: multilib) + AC_MSG_CHECKING([for multiple personalities]) + AC_ARG_ENABLE([schizo], + diff --git a/sys-apps/sandbox/files/sandbox-2.6-log-var.patch b/sys-apps/sandbox/files/sandbox-2.6-log-var.patch new file mode 100644 index 0000000..bfea9e5 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.6-log-var.patch @@ -0,0 +1,51 @@ +From 853b42c86432eefc6d4cfba86197fb37d446366d Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Sun, 3 Mar 2013 05:34:09 -0500 +Subject: [PATCH] sandbox: accept SANDBOX_LOG vars whatever their values + +Commit 40abb498ca4a24495fe34e133379382ce8c3eaca subtly broke the sandbox +with portage. It changed how the sandbox log env var was accessed by +moving from getenv() to get_sandbox_log(). The latter has path checking +and will kick out values that contain a slash. That means every time a +new process starts, a new sandbox log path will be generated, and when a +program triggers a violation, it'll write to the new file. Meanwhile, +portage itself watches the original one which never gets updated. + +This code has been around forever w/out documentation, and I can't think +of a reason we need it. So punt it. + +Signed-off-by: Mike Frysinger +--- + libsbutil/get_sandbox_log.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/libsbutil/get_sandbox_log.c b/libsbutil/get_sandbox_log.c +index a79b399..bdb4278 100644 +--- a/libsbutil/get_sandbox_log.c ++++ b/libsbutil/get_sandbox_log.c +@@ -21,17 +21,13 @@ static void _get_sb_log(char *path, const char *tmpdir, const char *env, const c + + sandbox_log_env = getenv(env); + +- if (sandbox_log_env && is_env_on(ENV_SANDBOX_TESTING)) { +- /* When testing, just use what the env says to */ ++ if (sandbox_log_env) { ++ /* If the env is viable, roll with it. We aren't really ++ * about people breaking the security of the sandbox by ++ * exporting SANDBOX_LOG=/dev/null. ++ */ + strncpy(path, sandbox_log_env, SB_PATH_MAX); + } else { +- /* THIS CHUNK BREAK THINGS BY DOING THIS: +- * SANDBOX_LOG=/tmp/sandbox-app-admin/superadduser-1.0.7-11063.log +- */ +- if ((NULL != sandbox_log_env) && +- (NULL != strchr(sandbox_log_env, '/'))) +- sandbox_log_env = NULL; +- + snprintf(path, SB_PATH_MAX, "%s%s%s%s%d%s", + SANDBOX_LOG_LOCATION, prefix, + (sandbox_log_env == NULL ? "" : sandbox_log_env), +-- +1.8.1.2 + diff --git a/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch b/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch new file mode 100644 index 0000000..0101ece --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.6-open-nofollow.patch @@ -0,0 +1,54 @@ +From 45fa8714a1d35e6555083d88a71851ada2aacac4 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Mon, 24 Dec 2012 18:46:29 -0500 +Subject: [PATCH] libsandbox: handle open(O_NOFOLLOW) + +We don't check for O_NOFOLLOW in the open wrappers, so we end up +returning the wrong error when operating on broken symlinks. + +URL: https://bugs.gentoo.org/413441 +Reported-by: Marien Zwart +Signed-off-by: Mike Frysinger +--- + libsandbox/wrapper-funcs/__64_post.h | 1 + + libsandbox/wrapper-funcs/__64_pre.h | 1 + + libsandbox/wrapper-funcs/openat_pre_check.c | 2 +- + tests/open-2.sh | 10 ++++++++++ + tests/open.at | 1 + + 5 files changed, 14 insertions(+), 1 deletion(-) + create mode 100755 tests/open-2.sh + +diff --git a/libsandbox/wrapper-funcs/__64_post.h b/libsandbox/wrapper-funcs/__64_post.h +index 2fd2182..82d2a16 100644 +--- a/libsandbox/wrapper-funcs/__64_post.h ++++ b/libsandbox/wrapper-funcs/__64_post.h +@@ -1,3 +1,4 @@ + #undef SB64 + #undef stat ++#undef lstat + #undef off_t +diff --git a/libsandbox/wrapper-funcs/__64_pre.h b/libsandbox/wrapper-funcs/__64_pre.h +index 2132110..0b34b25 100644 +--- a/libsandbox/wrapper-funcs/__64_pre.h ++++ b/libsandbox/wrapper-funcs/__64_pre.h +@@ -1,3 +1,4 @@ + #define SB64 + #define stat stat64 ++#define lstat lstat64 + #define off_t off64_t +diff --git a/libsandbox/wrapper-funcs/openat_pre_check.c b/libsandbox/wrapper-funcs/openat_pre_check.c +index c827ee6..0127708 100644 +--- a/libsandbox/wrapper-funcs/openat_pre_check.c ++++ b/libsandbox/wrapper-funcs/openat_pre_check.c +@@ -29,7 +29,7 @@ bool sb_openat_pre_check(const char *func, const char *pathname, int dirfd, int + + /* Doesn't exist -> skip permission checks */ + struct stat st; +- if (-1 == stat(pathname, &st)) { ++ if (((flags & O_NOFOLLOW) ? lstat(pathname, &st) : stat(pathname, &st)) == -1) { + sb_debug_dyn("EARLY FAIL: %s(%s): %s\n", + func, pathname, strerror(errno)); + return false; +-- +1.8.1.2 + diff --git a/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch b/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch new file mode 100644 index 0000000..7fc0972 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.6-static-close-fd.patch @@ -0,0 +1,93 @@ +From a3ff1534945c3898332b2481c9fd355dfbd56e1f Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Sat, 23 Jun 2012 11:52:51 -0700 +Subject: [PATCH] libsandbox: clean up open file handles in parent tracing + process + +Currently, if a non-static app sets up a pipe (with cloexec enabled) and +executes a static app, the handle to that pipe is left open in the parent +process. This causes trouble when the parent is waiting for that to be +closed immediately. + +Since none of the fds in the forked parent process matter to us, we can +just go ahead and clean up all fds before we start tracing the child. + +URL: http://bugs.gentoo.org/364877 +Reported-by: Victor Stinner +Signed-off-by: Mike Frysinger +--- + libsandbox/trace.c | 3 +- + libsbutil/sb_close.c | 26 +++++++++++- + libsbutil/sbutil.h | 1 + + tests/Makefile.am | 2 + + tests/pipe-fork_static_tst.c | 18 +++++++++ + tests/pipe-fork_tst.c | 95 ++++++++++++++++++++++++++++++++++++++++++++ + tests/script-9.sh | 5 +++ + tests/script.at | 1 + + 8 files changed, 149 insertions(+), 2 deletions(-) + create mode 100644 tests/pipe-fork_static_tst.c + create mode 100644 tests/pipe-fork_tst.c + create mode 100755 tests/script-9.sh + +diff --git a/libsandbox/trace.c b/libsandbox/trace.c +index 32ad2d6..dfbab18 100644 +--- a/libsandbox/trace.c ++++ b/libsandbox/trace.c +@@ -504,8 +504,9 @@ void trace_main(const char *filename, char *const argv[]) + /* Not all kernel versions support this, so ignore return */ + ptrace(PTRACE_SETOPTIONS, trace_pid, NULL, (void *)PTRACE_O_TRACESYSGOOD); + #endif ++ sb_close_all_fds(); + trace_loop(); +- return; ++ sb_ebort("ISE: child should have quit, as should we\n"); + } + + sb_debug("child setting up ..."); +diff --git a/libsbutil/sb_close.c b/libsbutil/sb_close.c +index 17a4560..5379197 100644 +--- a/libsbutil/sb_close.c ++++ b/libsbutil/sb_close.c +@@ -29,3 +29,27 @@ int sb_close(int fd) + + return res; + } ++ ++/* Quickly close all the open fds (good for daemonization) */ ++void sb_close_all_fds(void) ++{ ++ DIR *dirp; ++ struct dirent *de; ++ int dfd, fd; ++ const char *fd_dir = sb_get_fd_dir(); ++ ++ dirp = opendir(fd_dir); ++ if (!dirp) ++ sb_ebort("could not process %s\n", fd_dir); ++ dfd = dirfd(dirp); ++ ++ while ((de = readdir(dirp)) != NULL) { ++ if (de->d_name[0] == '.') ++ continue; ++ fd = atoi(de->d_name); ++ if (fd != dfd) ++ close(fd); ++ } ++ ++ closedir(dirp); ++} +diff --git a/libsbutil/sbutil.h b/libsbutil/sbutil.h +index 02b88cb..479734b 100644 +--- a/libsbutil/sbutil.h ++++ b/libsbutil/sbutil.h +@@ -97,6 +97,7 @@ int sb_open(const char *path, int flags, mode_t mode); + size_t sb_read(int fd, void *buf, size_t count); + size_t sb_write(int fd, const void *buf, size_t count); + int sb_close(int fd); ++void sb_close_all_fds(void); + int sb_copy_file_to_fd(const char *file, int ofd); + + /* Reliable output */ +-- +1.8.1.2 + diff --git a/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch b/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch new file mode 100644 index 0000000..7e73822 --- /dev/null +++ b/sys-apps/sandbox/files/sandbox-2.6-trace-hppa.patch @@ -0,0 +1,27 @@ +From 7b01f6103a9baddaf0252e7f850a4cef91a48b67 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Fri, 6 Jul 2012 14:58:16 -0400 +Subject: [PATCH] libsandbox: fix hppa trace code + +URL: https://bugs.gentoo.org/425062 +Reported-by: Jeroen Roovers +Signed-off-by: Mike Frysinger +--- + libsandbox/trace/linux/hppa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libsandbox/trace/linux/hppa.c b/libsandbox/trace/linux/hppa.c +index d23b0d1..5414354 100644 +--- a/libsandbox/trace/linux/hppa.c ++++ b/libsandbox/trace/linux/hppa.c +@@ -1,5 +1,5 @@ +-#define trace_reg_sysnum (20 * 4) /* PT_GR20 */ +-#define trace_reg_ret (28 * 4) /* PT_GR28 */ ++#define trace_reg_sysnum gr[20] ++#define trace_reg_ret gr[28] + + static unsigned long trace_arg(void *vregs, int num) + { +-- +1.7.9.7 + diff --git a/sys-apps/sandbox/sandbox-2.6-r1.ebuild b/sys-apps/sandbox/sandbox-2.6-r1.ebuild new file mode 100644 index 0000000..25130d2 --- /dev/null +++ b/sys-apps/sandbox/sandbox-2.6-r1.ebuild @@ -0,0 +1,132 @@ +# Copyright 1999-2013 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sys-apps/sandbox/sandbox-2.6-r1.ebuild,v 1.12 2013/07/02 07:43:42 ago Exp $ + +# +# don't monkey with this ebuild unless contacting portage devs. +# period. +# + +inherit autotools eutils flag-o-matic toolchain-funcs multilib unpacker multiprocessing + +DESCRIPTION="sandbox'd LD_PRELOAD hack" +HOMEPAGE="http://www.gentoo.org/" +SRC_URI="mirror://gentoo/${P}.tar.xz + http://dev.gentoo.org/~vapier/dist/${P}.tar.xz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="alpha amd64 arm hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~sparc-fbsd -x86-fbsd" +IUSE="multilib pch" + +DEPEND="app-arch/xz-utils + >=app-misc/pax-utils-0.1.19" #265376 +RDEPEND="" + +EMULTILIB_PKG="true" +has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS="${EBUILD_DEATH_HOOKS} sandbox_death_notice" + +sandbox_death_notice() { + ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:" + ewarn "FEATURES=-sandbox emerge sandbox" +} + +sb_get_install_abis() { use multilib && get_install_abis || echo ${ABI:-default} ; } + +sb_foreach_abi() { + local OABI=${ABI} + for ABI in $(sb_get_install_abis) ; do + cd "${WORKDIR}/build-${ABI}" + einfo "Running $1 for ABI=${ABI}..." + "$@" + done + ABI=${OABI} +} + +src_unpack() { + unpacker + cd "${S}" + epatch "${FILESDIR}"/${P}-trace-hppa.patch #425062 + epatch "${FILESDIR}"/${P}-log-var.patch + epatch "${FILESDIR}"/${P}-static-close-fd.patch #364877 + epatch "${FILESDIR}"/${P}-desktop.patch #443672 + epatch "${FILESDIR}"/${P}-open-nofollow.patch #413441 + epatch "${FILESDIR}"/${P}-check-empty-paths-at.patch #346929 + epatch "${FILESDIR}"/${P}-hardened-pch.patch #425524 + epatch_user + + eautoreconf +} + +sb_configure() { + mkdir "${WORKDIR}/build-${ABI}" + cd "${WORKDIR}/build-${ABI}" + + use multilib && multilib_toolchain_setup ${ABI} + + einfo "Configuring sandbox for ABI=${ABI}..." + ECONF_SOURCE="../${P}/" \ + econf $(use_enable pch) ${myconf} || die +} + +sb_compile() { + emake || die +} + +src_compile() { + filter-lfs-flags #90228 + + # Run configures in parallel! + multijob_init + local OABI=${ABI} + for ABI in $(sb_get_install_abis) ; do + multijob_child_init sb_configure + done + ABI=${OABI} + multijob_finish + + sb_foreach_abi sb_compile +} + +sb_test() { + emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)" || die +} + +src_test() { + sb_foreach_abi sb_test +} + +sb_install() { + emake DESTDIR="${D}" install || die + insinto /etc/sandbox.d #333131 + doins etc/sandbox.d/00default || die +} + +src_install() { + sb_foreach_abi sb_install + + doenvd "${FILESDIR}"/09sandbox + + keepdir /var/log/sandbox + fowners root:portage /var/log/sandbox + fperms 0770 /var/log/sandbox + + cd "${S}" + dodoc AUTHORS ChangeLog* NEWS README +} + +pkg_preinst() { + chown root:portage "${D}"/var/log/sandbox + chmod 0770 "${D}"/var/log/sandbox + + local old=$(find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*') + if [[ -n ${old} ]] ; then + elog "Removing old sandbox libraries for you:" + elog ${old//${ROOT}} + find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*' -exec rm -fv {} \; + fi +} + +pkg_postinst() { + chmod 0755 "${ROOT}"/etc/sandbox.d #265376 +}