From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-14) on finch.gentoo.org X-Spam-Level: X-Spam-Status: No, score=-0.1 required=5.0 tests=DMARC_NONE,MAILING_LIST_MULTI autolearn=unavailable autolearn_force=no version=4.0.0 Received: from bigglesworth.mail.be.easynet.net (bigglesworth.mail.be.easynet.net [212.100.160.67]) by chiba.3jane.net (Postfix) with ESMTP id 2F2BBEE49 for ; Fri, 30 Nov 2001 22:32:13 -0600 (CST) Received: from 213-193-176-100.adsl.easynet.be ([213.193.176.100]) by bigglesworth.mail.be.easynet.net with esmtp (Exim 3.16 #1) id 16A1o5-0008Ko-00 for gentoo-dev@gentoo.org; Sat, 01 Dec 2001 05:31:17 +0100 From: Geert Bevin To: gentoo-dev@gentoo.org Content-Type: multipart/mixed; boundary="=-crpFwaFn0Tf+7OYJ75t9" X-Mailer: Evolution/0.99.2 (Preview Release) Date: 01 Dec 2001 05:31:21 +0100 Message-Id: <1007181082.1120.0.camel@inspiron.theleaf.office> Mime-Version: 1.0 Subject: [gentoo-dev] Path sandbox using ld_preload Sender: gentoo-dev-admin@gentoo.org Errors-To: gentoo-dev-admin@gentoo.org X-BeenThere: gentoo-dev@gentoo.org X-Mailman-Version: 2.0.6 Precedence: bulk Reply-To: gentoo-dev@gentoo.org List-Help: List-Post: List-Subscribe: , List-Id: Developer discussion list List-Unsubscribe: , List-Archive: X-Archives-Salt: 1d91de77-6205-4e41-a01d-0ba8da638644 X-Archives-Hash: 4f4bf3157572329da64a9491e70d79fe --=-crpFwaFn0Tf+7OYJ75t9 Content-Type: text/plain Content-Transfer-Encoding: 7bit Hello, during the past days I've been working on a path sandbox which prevents any user read or write access to specified directory prefixes. Initially I worked on code of karltk which makes use of ptrace to trace the system calls directly. Due to lack of documentation and obscure beviour I've postponed the work on that version. I've therefor started the approach of providing alternative implementations of all file functions that are offered by glibc. Attached is a first version of what I've come up with. After de-archiving, build the library with 'make -f sandbox.makefile'. You should quickly end up with a 'sandbox.so' file. Now just run the sandbox by executing './sandbox'. You should now be in the protected environment. Three environmental variables control the behaviour of the sandbox : SANDBOX_DENY : path prefixes that deny access in every way SANDBOX_READ : path prefixes that only allow read SANDBOX_WRITE : path prefixes that only allow write Note that write permissions don't imply read premissions. Seperate different entries in the regular way, with colons. You can adapt the variables at any time, the sandbox adapts itself dynamically. Since a few shell utilities reset the LD_PRELOAD variable that is needed for all this to work, I've created default aliases for 'make' and 'su'. This should ensure that the default usage of these commands maintain the protected environment. Probably there are other commands that behave this way, but I haven't found them yet. I hope this is of use and I'll start continue testing it and trying to measure and enhance its performance. Best regards, Geert -- Geert Bevin the Leaf sprl/bvba "Use what you need" Pierre Theunisstraat 1/47 http://www.theleaf.be 1030 Brussels gbevin@theleaf.be Tel & Fax +32 2 241 19 98 --=-crpFwaFn0Tf+7OYJ75t9 Content-Type: application/x-bzip Content-Disposition: attachment; filename=sandbox.tar.bz2 Content-Transfer-Encoding: base64 QlpoOTFBWSZTWQiResEAG6R/hv/7gQB///+/f//e7v/v3/4AASAAAAhgFB55QvjcjrjlnsGnWqAo Vj26dncDpWc2rbTN3O7BtmgAWGHXIAdaAphKEmpiZDKeibTUE2k9NRhGnpMm1M1A0NAaAAyPSZMg IoZIbUAAAAAAAAAAAAAAAA4GgNBo0DJoADQAGJoaaBpoAaNGgAaNBJpSE1NPVNip7Up5RvUm9EPU J5E8oYgAAaAAeoYgABEkSYlNo01CeU9EaDynqGaQAabUyD1A0ABtQaaAASJAgCaBATJimmmVPDQ1 J6jyaT1A/UmjT1DaQ9QA2mo9Tvh/x9f1bc/fiDwBowIIkyFAOv2OxydPCGYXCQ0NdjG1clwxHFIH jDSNCDEtFIwUtGBCTfL3Ty4IFPMAiDDFlMUKwWIMBAQMkhRCoSjJ/oD/gCAgQDATFAWAF6RCkA69 AqUrBQUVFkFWQYoICAwIkYRUEFksLIQi0pEZSQK03RMGAwWNLBgIGGgK0oFjGQVQxaKAuLAKgIgg DKtKAgMgkYBAIMUiR4idPRiyNqcyNiH0qf4r/BOZlaQOSqBYVJA7IUWdidQIFKAGwC0kSrEwOq4I ApYG2xt2660nakFUTAiPbmSmBBVVmQTAcicknWEptBfcwGNwBuzVBYqiw04+jKTv53WZtfDYf0zu eZ2WqrKht8ycfTLyzRDVHOeR83gRD4XXreVEnlndC/g0ZKCw1ItdjqK6h2TQHDpbmlFFPMJoKqlr LnQiI4pzxuHkq4YOVdgHfrNlgzIAvxZ8MzIU7FUYJxSqqoLNwCBrZFzqHAkk9oOMDw5Hjh/Uy22p 2AzvMNSzx7s9cgzggf37dQ7fdoaKqIw7pRAYmtWfYFzcgieF8KAQDrX8M4pt5+M6CdxD0gGEU0Z+ cHnDMvB/H7uYaxg6899Z+70zqkZfb1yOwmDOJ+GZUv2WfeF4kvWNcWfExsGxMKi952e81+l3Kj+j 2etEwwYFj2HSH7cbKULzSRoBNX/DffcqB7QDXID98gCaVxywPRkAFf3Ab3serBC/85dyW9hne4TM xugQ1eVK0SQGBF5INIEMVl/WRYkTTYhsfO7rVueLSht0yFqVEI+v1O/TVMBrEQqpr4FC8Gq5GGFJ O/ueW/wlLBDaBFlIGbYW6CmAcoZIr3tMu4a3yd3b3g1kFAFhA6Fpr5/CGIHFAGJFFiCouMqdfHka HG5dGmAsZYppBDGAADBEMDThGCA4tCWAICADcRRRDTpQz5DAWqyI9bV3sOdVvz9ktUG95XFaRwRq miTnHBxvBOoIJZczln0U2yttfgPLaNmnuvnryKk2mwKWdKIMhpZADQFQJHCkwKHsbbayz1lGXZhD MlQDkAXZFM4iCr79rJdlUb69ONrGsRQc90zQH9FK4UuiVyC1aIKcKuQEAdfI6WcLduUpZFzHXAPo kRGIiKzGyMGGetm426LMIXFzjzc8seStJXqWruoU1vilzCsprsrJ5ZOvXbNt65Z63SKQVviRDcF1 5TWnnu821KccMnkBd+i+3ihLcHtAv1Wb+QhyW2fNXFFUWa1WLDVrVt/QlugqmuubajllkkdA3RdT tPL7Po5mNTdgSUcjkkhsOsbGKGNo+sS9QSFCQ/793IA0AE6e10ZrROzkejLPS1mx+AgwGJhS0HWG p8VQJIDq3mApnR4nw0pOvOwGPh+15Or7ZpCeY86m1qecaqD9CiJwGaSez7PVF7BgVGMY201GdOXA 5UB3hIg04ykOUufprB8Akq2mlI23O/aW+darMwM2cuR0kw33HC0PisTNwiDQkvnsBMmfXbzn33rn C25zOhzr6r/mVW2MY3oyG2m0maY4R8/bB/tdvW83nvABw36aGAHh3PuRVcTd2cVxy7DOjvOJgE8w N63j3nCDfMmdWl8o4mspbqYyyfPqZO83cJKzMJRTeatF4NLyYg5sULcGME2oKkScp/G4+HqhKdju kFdYSm1gepQlDMwKJVmSAdEchA+niyZmiCzNEcbgI8DwiSKEoJSfqKkEtfFH2I6ag5Lfz9/f2pm0 x8+dMDqp9mSgPFCLxoJCZ3rzCu8PKXGgZF+CYFETV/eTAmgU0KweT2LBVyua3tVYvf8bcHXlXR05 P5nxpTQ5vDfCKFjWaN0XLG1Bnjthp6wnMhzYUssUNxy9KmwzRRYkHV97LlQg0ZdESPQrIj+TdHGM KEwwO80aDYGj/U6zDoXDHDPnhSoV4VKGtFIqRyVV+63cZ8UdMaJ/LiIYDdh4N3YENVTbzGxuLmiy rMtOykUum8ZUrWow9QaOJQNlCARE5DeZB+A4oQDbBNdggBenpoxwg8PCYgl4iR03Y6HbMgrFA5XY BbzAOAIcpCEO04LZSSQQJHBlQjGD7s4+V5hWAnNZp6TMyKfLH4mZNfVm4AXE4CIimQWVjA4YEd4b PRyl9vCcsF14Bl8RMHESWaaaapaxhLLhKMyj+6xGYrkloE51Ca3zrEqcrBTCdHOkYWJSZbyWwmNY 3ksdl0i2FB4KsmKwaimbKwGEgNffuz7+124GfnLkA+wDEYiTgBEbGSnKcJLJ4097Tnh+u7jPIm/K maVgs0QVajELGaamRljhiH1tj2zztfWy3hT34kACIBJEJ+sQKigQhw0yCv6D3fSevCP0v7XeIF8u 4FWRv+398st55ZtsnSogawyc+f5vze78A+3eIMy49szD9Q9f2BuDDGxmw/FIMVYbC6/IVDVD2zfC aNJSsbjXTYJouKYsuwMTQDc0PWR+wmGhV4A6fgjrzAyQzWdnf9WExCxxoGyMxOYhcdgtrZLYLv/X v5BeJGU8FOZD/FdCWCQRKZ9Zy0DljvCfHo6eq7qEGnS6hJSFAKEHiuMFyh4RrPHetyBKDwoColhk LstCn89dkxjhmxKUsw2eq91X7rFg82/HtglyO0fMdp7glFZm4cl0HOBC31pEuEpzjgdpBhxoILul 9VdzrEWuX907LGCDc2EZUky7ymUYOYA5wLP6fWGZXAH/YHlUCSCP3JiPwAwWLbdAJGGGGDr7i8yM c4Zgab2Kqv5syB2TjPw3Sb/P3CduLzcveQDSHIOVFByFJw2LwOzCt/o/G9o59inMHI3D3eUBkMyH 6wA5TOd09vMn3z0SeSTV71W671VVyw5LaUpba2tynSDoQxA6lVgZodMQMoqh8f8/pDigLkz6kmkj zcoCQ1xWmPLI0S6N3Xi0mD0mtXGfEdwiLoCJr1a9rS2UErB1IhLo+kYlWTRsaB8oC1YCBsV3+ZYc jp5AXIEYMCDBQyqgMdF1Ny8+RMgxz0osWCnKnM+UfVSHUfx6OITY7/7vnHFQWQwxY8150UVf8H+k KCJZIBpfrlyOLbx4LKSeBPTRd3qGAX6AdURN7qKstmmTLiyKVT0TWmWVaYBiiVMXcGp3KEiNVuCC UkwUJoYmCDETkxv5H0dcpRLQWW+AsquC4FkADVlRBvghJ4mxEZCpPgiaTarOex4SdPTI8Eh1ngbM uVuLLimG4tdzhF5bKabhmJTLr03ZABBMQvdQx0gxTaNmzA7/M4EEjuJz0xxi5roZQY0FdLBmYYGZ oqPxzNHcHiDPjad90S+tOB0vGknrHvyMPO6VBMDdhcGzLnuKEik1PGhlWtSHRoY7sInQn7xceNrN 6XQ8ZklRhad+mZdjfdmtgMjPbfhZIKBjqbAFSMpvoBjNr1U7W1pw75qAMBDSBAebBc7Ddm2PZGiC Qylu3YXNkoI887C9bUz24huYgmkINyQUOfDiU0LB4elh4M3JHH47cDVPiygElCSMRivZsqKFoHSl UfUztze9h54gHvEf/BdXzYnQpVe90F1KshFAwAOQB3QBkAMB7dQWDmdU+0DHhCSG4YIMtuQmJLA5 JE/AvkUEiZfnzD4X2sKLFUX1OaSXwer6nf9bEknfaYuFwQswLUHH5rhkbJwY11VxXa6Bl0N7EeMi whdFRh3vAZuQwmkD8xJOITDW9ULABMdyHCV3cultJAQgDResNsjIuSIZVmSmXN3xA7OanFFCeUI0 kCYKGqB66QmRMoR8bUxjmu8rOqc0QR3zjpgDgho+9BlTrC4kQo+ANkGBzKeHJB0NJZNHbC9O4rmI C4vmu5pByOma2SqGB6EUjwUqLhMFegMZvVTbneK9aiJ0CExHeuZMQHYuRgg54cNNEmwbVJCNfLiY psabHdJ41J6NSRwvQrBxPO6KOKQg0CS3DUzrSscu4ZUU5hqX6kFU0ZxWQFgGhjRWdKb50hpWEfJN Y7vJ3mbyAD5CSPS12MZpAhsvIRPiB1rSs42H571PMwDhx3TiUVd4YDARwCUaEkTvQUKXw3lsklVX AtgOOBofSWyWRaPnmEJOf3EAGZo/R7giauEayRzLxKTBCbQDxMbC4smrWgMZNt3o8yj4PAhI4cUg GLK/N4sJKBSlJaRKYNTZOSAsyyuBvzR+eGhSZszYZ0tG67jEHDLJpCNR3MTSDbqUq8EA4QKq9gKA toQTvZaBgOTdc1hECN26BGGmUNqW0GisEAOuZg6wLmhxDEsCBYS0AjBIxUJGUylNRTnqHLLwbLeo QhCEDMyVyYj3ukAOS3OWkQeJAQeRW+UABh5wvcuTaSmhYhT5i0L0oPEyA94RcB6QGAWAt3HTqgow uZrpaRVJAUt03LI2jd6Io5uEvAWInKE8P14ysjGspHpZJ6VgQbAVA/aB2ARbG24C2sC4qU1PlMnx HXnCRoBVo51tXMiALZYSZJ6Qvopkd+8aSBlZFgkSOt+0BmYvZ5SxGYpJNoNpCmEUWqL6Z1jDsMpw 7fKYx2RPE9QenYUkEwlLVGew1DGvtp10wZ+CjrCm5IAWI7wmpShNomlrIm18qrevpISMe4z9OOaQ HNQajG2INlLkz4B9E+Inv0vJHgadIdqQgns7rqSEeg0aUZNB2yGMSg0zSBGxsgDvcaINuaFIDdf0 nNIGA099FvQAXXo30wQUVLBmCywkkAWYpMLJJY/MBKYEASA3JSgB5gYh4kddy7ZmJWYqRK1pf5Bd Q/4fczdul5ZUVGOyglY6yBZsLk4axGkaEqyfQNQgY0hflt4/c/NI/Jrtn04AJX5JbJjtxODmMUy6 ficbKRwHHCT1D24tFPUln+jtNZC7c9yQA3MMOGCjv3zlNOdvq1BnFIxsIJjSHn5HquLq8zzQSA6p uiu3wiXvhDE8RVwRLLhF33pJgh6OoMEgliwbDnp4XKySSZNovqAQlNgc3TIKz1wzxLqLpuDLRN/U QpWZCMQwwiCEEwGkUrFGmgqIxkxE0VjrmGCQSLQA65E4UCYiUPGiRSvS6a+tBeE0E/EZIaCHRB0s EvN+XfaYtIgcCjZejcE1SPTiQZj86z78e1oOY+7vij6MM4z1ZCBKZ0drEjpUrlrXrH/Gr9RcgXYk XDD58S9XoRzaDJAuwC6oAqn8JLw8I7ShxEjs5U7GvyDn9gcL3xSf32zekRkt6bQPqgH+pPIphzsd laDFdwNmdrIsvj5K7uaOuHsSzgy+JPMO2W0VRYqgCig792pwXlA3AwTPfNgCAQDQEFjgebq5Ks+X Dxk1QCJiPOAXlQrJCAxDoANgGLmNIKA5z/UXNFugYEBMJFd/5bNxB/8XckU4UJAIkXrB --=-crpFwaFn0Tf+7OYJ75t9--