···

       
2
       
 
       
#include <stdio.h>

     

       
3
       
 
       
#include <string.h>

     

       
4
       
 
       
#include <unistd.h>

     

       
0
       
 
       

     

       
5
       
 
       
#include <sys/types.h>

     

       
6
       
 
       
#include <sys/stat.h>

     

       
7
       
 
       
#include <sys/xattr.h>

     

       
8
       
 
       
#include <fcntl.h>

     

       
9
       
 
       
#include <dirent.h>

     

       
10
       
-
       
#include <assert.h>

     

       
11
       
 
       
#include <errno.h>

     

       
12
       
 
       
#include <linux/capability.h>

     

       
13
       
 
       
#include <sys/prctl.h>

     
···

       
16
       
 
       
#include <syscall.h>

     

       
17
       
 
       
#include <byteswap.h>

     

       
18
       
 
       


     

       
19
       
-
       
// Make sure assertions are not compiled out, we use them to codify

     

       
20
       
-
       
// invariants about this program and we want it to fail fast and

     

       
21
       
-
       
// loudly if they are violated.

     

       
22
       
-
       
#undef NDEBUG

     

       
23
       
 
       


     

       
24
       
 
       
extern char **environ;

     

       
25
       
 
       


     
···

       
37
       
 
       
#else

     

       
38
       
 
       
#define LE32_TO_H(x) (x)

     

       
39
       
 
       
#endif

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
40
       
 
       


     

       
41
       
 
       
int get_last_cap(unsigned *last_cap) {

     

       
42
       
 
       
    FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r");

     
···

       
181
       
 
       
    int len = strlen(wrapper_dir);

     

       
182
       
 
       
    if (len > 0 && '/' == wrapper_dir[len - 1])

     

       
183
       
 
       
      --len;

     

       
184
       
-
       
    assert(!strncmp(self_path, wrapper_dir, len));

     

       
185
       
-
       
    assert('/' == wrapper_dir[0]);

     

       
186
       
-
       
    assert('/' == self_path[len]);

     

       
187
       
 
       


     

       
188
       
 
       
    // Make *really* *really* sure that we were executed as

     

       
189
       
 
       
    // `self_path', and not, say, as some other setuid program. That

     

       
190
       
 
       
    // is, our effective uid/gid should match the uid/gid of

     

       
191
       
 
       
    // `self_path'.

     

       
192
       
 
       
    struct stat st;

     

       
193
       
-
       
    assert(lstat(self_path, &st) != -1);

     

       
194
       
 
       


     

       
195
       
-
       
    assert(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));

     

       
196
       
-
       
    assert(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));

     

       
197
       
 
       


     

       
198
       
 
       
    // And, of course, we shouldn't be writable.

     

       
199
       
-
       
    assert(!(st.st_mode & (S_IWGRP | S_IWOTH)));

     

       
200
       
 
       


     

       
201
       
 
       
    // Read the path of the real (wrapped) program from <self>.real.

     

       
202
       
 
       
    char real_fn[PATH_MAX + 10];

     

       
203
       
 
       
    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);

     

       
204
       
-
       
    assert(real_fn_size < sizeof(real_fn));

     

       
205
       
 
       


     

       
206
       
 
       
    int fd_self = open(real_fn, O_RDONLY);

     

       
207
       
-
       
    assert(fd_self != -1);

     

       
208
       
 
       


     

       
209
       
 
       
    char source_prog[PATH_MAX];

     

       
210
       
 
       
    len = read(fd_self, source_prog, PATH_MAX);

     

       
211
       
-
       
    assert(len != -1);

     

       
212
       
-
       
    assert(len < sizeof(source_prog));

     

       
213
       
-
       
    assert(len > 0);

     

       
214
       
 
       
    source_prog[len] = 0;

     

       
215
       
 
       


     

       
216
       
 
       
    close(fd_self);

     

···

       
2
       
 
       
#include <stdio.h>

     

       
3
       
 
       
#include <string.h>

     

       
4
       
 
       
#include <unistd.h>

     

       
5
       
+
       
#include <stdnoreturn.h>

     

       
6
       
 
       
#include <sys/types.h>

     

       
7
       
 
       
#include <sys/stat.h>

     

       
8
       
 
       
#include <sys/xattr.h>

     

       
9
       
 
       
#include <fcntl.h>

     

       
10
       
 
       
#include <dirent.h>

     

       
0
       
 
       

     

       
11
       
 
       
#include <errno.h>

     

       
12
       
 
       
#include <linux/capability.h>

     

       
13
       
 
       
#include <sys/prctl.h>

     
···

       
16
       
 
       
#include <syscall.h>

     

       
17
       
 
       
#include <byteswap.h>

     

       
18
       
 
       


     

       
19
       
+
       
#define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
20
       
 
       


     

       
21
       
 
       
extern char **environ;

     

       
22
       
 
       


     
···

       
34
       
 
       
#else

     

       
35
       
 
       
#define LE32_TO_H(x) (x)

     

       
36
       
 
       
#endif

     

       
37
       
+
       


     

       
38
       
+
       
static noreturn void assert_failure(const char *assertion) {

     

       
39
       
+
       
    fprintf(stderr, "Assertion `%s` in NixOS's wrapper.c failed.\n", assertion);

     

       
40
       
+
       
    fflush(stderr);

     

       
41
       
+
       
    abort();

     

       
42
       
+
       
}

     

       
43
       
 
       


     

       
44
       
 
       
int get_last_cap(unsigned *last_cap) {

     

       
45
       
 
       
    FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r");

     
···

       
184
       
 
       
    int len = strlen(wrapper_dir);

     

       
185
       
 
       
    if (len > 0 && '/' == wrapper_dir[len - 1])

     

       
186
       
 
       
      --len;

     

       
187
       
+
       
    ASSERT(!strncmp(self_path, wrapper_dir, len));

     

       
188
       
+
       
    ASSERT('/' == wrapper_dir[0]);

     

       
189
       
+
       
    ASSERT('/' == self_path[len]);

     

       
190
       
 
       


     

       
191
       
 
       
    // Make *really* *really* sure that we were executed as

     

       
192
       
 
       
    // `self_path', and not, say, as some other setuid program. That

     

       
193
       
 
       
    // is, our effective uid/gid should match the uid/gid of

     

       
194
       
 
       
    // `self_path'.

     

       
195
       
 
       
    struct stat st;

     

       
196
       
+
       
    ASSERT(lstat(self_path, &st) != -1);

     

       
197
       
 
       


     

       
198
       
+
       
    ASSERT(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));

     

       
199
       
+
       
    ASSERT(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));

     

       
200
       
 
       


     

       
201
       
 
       
    // And, of course, we shouldn't be writable.

     

       
202
       
+
       
    ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));

     

       
203
       
 
       


     

       
204
       
 
       
    // Read the path of the real (wrapped) program from <self>.real.

     

       
205
       
 
       
    char real_fn[PATH_MAX + 10];

     

       
206
       
 
       
    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);

     

       
207
       
+
       
    ASSERT(real_fn_size < sizeof(real_fn));

     

       
208
       
 
       


     

       
209
       
 
       
    int fd_self = open(real_fn, O_RDONLY);

     

       
210
       
+
       
    ASSERT(fd_self != -1);

     

       
211
       
 
       


     

       
212
       
 
       
    char source_prog[PATH_MAX];

     

       
213
       
 
       
    len = read(fd_self, source_prog, PATH_MAX);

     

       
214
       
+
       
    ASSERT(len != -1);

     

       
215
       
+
       
    ASSERT(len < sizeof(source_prog));

     

       
216
       
+
       
    ASSERT(len > 0);

     

       
217
       
 
       
    source_prog[len] = 0;

     

       
218
       
 
       


     

       
219
       
 
       
    close(fd_self);