commit 1009d6e79e7f4ef92d7db27214c55a36f5e22c6f · pyrox.dev/nixpkgs

+20 -17
nixos/modules/security/wrappers/wrapper.c
···

       2
       2
        
       #include <stdio.h>

     

       3
       3
        
       #include <string.h>

     

       4
       4
        
       #include <unistd.h>

     

       5
       5
       +
       #include <stdnoreturn.h>

     

       5
       6
        
       #include <sys/types.h>

     

       6
       7
        
       #include <sys/stat.h>

     

       7
       8
        
       #include <sys/xattr.h>

     

       8
       9
        
       #include <fcntl.h>

     

       9
       10
        
       #include <dirent.h>

     

       10
       10
       -
       #include <assert.h>

     

       11
       11
        
       #include <errno.h>

     

       12
       12
        
       #include <linux/capability.h>

     

       13
       13
        
       #include <sys/prctl.h>

     
···

       16
       16
        
       #include <syscall.h>

     

       17
       17
        
       #include <byteswap.h>

     

       18
       18
        
       

     

       19
       19
       -
       // Make sure assertions are not compiled out, we use them to codify

     

       20
       20
       -
       // invariants about this program and we want it to fail fast and

     

       21
       21
       -
       // loudly if they are violated.

     

       22
       22
       -
       #undef NDEBUG

     

       19
       19
       +
       #define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))

     

       23
       20
        
       

     

       24
       21
        
       extern char **environ;

     

       25
       22
        
       

     
···

       37
       34
        
       #else

     

       38
       35
        
       #define LE32_TO_H(x) (x)

     

       39
       36
        
       #endif

     

       37
       37
       +
       

     

       38
       38
       +
       static noreturn void assert_failure(const char *assertion) {

     

       39
       39
       +
           fprintf(stderr, "Assertion `%s` in NixOS's wrapper.c failed.\n", assertion);

     

       40
       40
       +
           fflush(stderr);

     

       41
       41
       +
           abort();

     

       42
       42
       +
       }

     

       40
       43
        
       

     

       41
       44
        
       int get_last_cap(unsigned *last_cap) {

     

       42
       45
        
           FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r");

     
···

       181
       184
        
           int len = strlen(wrapper_dir);

     

       182
       185
        
           if (len > 0 && '/' == wrapper_dir[len - 1])

     

       183
       186
        
             --len;

     

       184
       184
       -
           assert(!strncmp(self_path, wrapper_dir, len));

     

       185
       185
       -
           assert('/' == wrapper_dir[0]);

     

       186
       186
       -
           assert('/' == self_path[len]);

     

       187
       187
       +
           ASSERT(!strncmp(self_path, wrapper_dir, len));

     

       188
       188
       +
           ASSERT('/' == wrapper_dir[0]);

     

       189
       189
       +
           ASSERT('/' == self_path[len]);

     

       187
       190
        
       

     

       188
       191
        
           // Make *really* *really* sure that we were executed as

     

       189
       192
        
           // `self_path', and not, say, as some other setuid program. That

     

       190
       193
        
           // is, our effective uid/gid should match the uid/gid of

     

       191
       194
        
           // `self_path'.

     

       192
       195
        
           struct stat st;

     

       193
       193
       -
           assert(lstat(self_path, &st) != -1);

     

       196
       196
       +
           ASSERT(lstat(self_path, &st) != -1);

     

       194
       197
        
       

     

       195
       195
       -
           assert(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));

     

       196
       196
       -
           assert(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));

     

       198
       198
       +
           ASSERT(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));

     

       199
       199
       +
           ASSERT(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));

     

       197
       200
        
       

     

       198
       201
        
           // And, of course, we shouldn't be writable.

     

       199
       199
       -
           assert(!(st.st_mode & (S_IWGRP | S_IWOTH)));

     

       202
       202
       +
           ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));

     

       200
       203
        
       

     

       201
       204
        
           // Read the path of the real (wrapped) program from <self>.real.

     

       202
       205
        
           char real_fn[PATH_MAX + 10];

     

       203
       206
        
           int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);

     

       204
       204
       -
           assert(real_fn_size < sizeof(real_fn));

     

       207
       207
       +
           ASSERT(real_fn_size < sizeof(real_fn));

     

       205
       208
        
       

     

       206
       209
        
           int fd_self = open(real_fn, O_RDONLY);

     

       207
       207
       -
           assert(fd_self != -1);

     

       210
       210
       +
           ASSERT(fd_self != -1);

     

       208
       211
        
       

     

       209
       212
        
           char source_prog[PATH_MAX];

     

       210
       213
        
           len = read(fd_self, source_prog, PATH_MAX);

     

       211
       211
       -
           assert(len != -1);

     

       212
       212
       -
           assert(len < sizeof(source_prog));

     

       213
       213
       -
           assert(len > 0);

     

       214
       214
       +
           ASSERT(len != -1);

     

       215
       215
       +
           ASSERT(len < sizeof(source_prog));

     

       216
       216
       +
           ASSERT(len > 0);

     

       214
       217
        
           source_prog[len] = 0;

     

       215
       218
        
       

     

       216
       219
        
           close(fd_self);