forked from netblue30/firejail
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
jaitest - simple sandbox testing utility program
- Loading branch information
Showing
14 changed files
with
794 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| all: jailtest | ||
|
|
||
| include ../common.mk | ||
|
|
||
| %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/pid.h | ||
| $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
|
|
||
| jailtest: $(OBJS) | ||
| $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS) | ||
|
|
||
| clean:; rm -fr *.o jailtest *.gcov *.gcda *.gcno *.plist | ||
|
|
||
| distclean: clean | ||
| rm -fr Makefile |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,124 @@ | ||
| #include "jailtest.h" | ||
| #include <dirent.h> | ||
| #include <sys/wait.h> | ||
|
|
||
| typedef struct { | ||
| char *tfile; | ||
| char *tdir; | ||
| } TestDir; | ||
|
|
||
| #define MAX_TEST_FILES 16 | ||
| TestDir td[MAX_TEST_FILES]; | ||
| static int files_cnt = 0; | ||
|
|
||
| void access_setup(const char *directory) { | ||
| // I am root! | ||
| assert(directory); | ||
| assert(user_home_dir); | ||
|
|
||
| if (files_cnt >= MAX_TEST_FILES) { | ||
| fprintf(stderr, "Error: maximum number of test directories exceded\n"); | ||
| exit(1); | ||
| } | ||
|
|
||
| char *fname = strdup(directory); | ||
| if (!fname) | ||
| errExit("strdup"); | ||
| if (strncmp(fname, "~/", 2) == 0) { | ||
| free(fname); | ||
| if (asprintf(&fname, "%s/%s", user_home_dir, directory + 2) == -1) | ||
| errExit("asprintf"); | ||
| } | ||
|
|
||
| char *path = realpath(fname, NULL); | ||
| free(fname); | ||
| if (path == NULL) { | ||
| fprintf(stderr, "Warning: invalid directory %s, skipping...\n", directory); | ||
| return; | ||
| } | ||
|
|
||
| // file in home directory | ||
| if (strncmp(path, user_home_dir, strlen(user_home_dir)) != 0) { | ||
| fprintf(stderr, "Warning: file %s is not in user home directory, skipping...\n", directory); | ||
| free(path); | ||
| return; | ||
| } | ||
|
|
||
| // try to open the dir as root | ||
| DIR *dir = opendir(path); | ||
| if (!dir) { | ||
| fprintf(stderr, "Warning: directory %s not found, skipping\n", directory); | ||
| free(path); | ||
| return; | ||
| } | ||
| closedir(dir); | ||
|
|
||
| // create a test file | ||
| char *test_file; | ||
| if (asprintf(&test_file, "%s/jailtest-access-%d", path, getpid()) == -1) | ||
| errExit("asprintf"); | ||
|
|
||
| FILE *fp = fopen(test_file, "w"); | ||
| if (!fp) { | ||
| printf("Warning: I cannot create test file in directory %s, skipping...\n", directory); | ||
| return; | ||
| } | ||
| fprintf(fp, "this file was created by firetest utility, you can safely delete it\n"); | ||
| fclose(fp); | ||
| int rv = chown(test_file, user_uid, user_gid); | ||
| if (rv) | ||
| errExit("chown"); | ||
|
|
||
| char *dname = strdup(directory); | ||
| if (!dname) | ||
| errExit("strdup"); | ||
| td[files_cnt].tdir = dname; | ||
| td[files_cnt].tfile = test_file; | ||
| files_cnt++; | ||
| } | ||
|
|
||
| void access_destroy(void) { | ||
| // remove test files | ||
| int i; | ||
|
|
||
| for (i = 0; i < files_cnt; i++) { | ||
| int rv = unlink(td[i].tfile); | ||
| (void) rv; | ||
| } | ||
| files_cnt = 0; | ||
| } | ||
|
|
||
| void access_test(void) { | ||
| // I am root in sandbox mount namespace | ||
| assert(user_uid); | ||
| int i; | ||
|
|
||
| pid_t child = fork(); | ||
| if (child == -1) | ||
| errExit("fork"); | ||
|
|
||
| if (child == 0) { // child | ||
| // drop privileges | ||
| if (setgid(user_gid) != 0) | ||
| errExit("setgid"); | ||
| if (setuid(user_uid) != 0) | ||
| errExit("setuid"); | ||
|
|
||
| for (i = 0; i < files_cnt; i++) { | ||
| assert(td[i].tfile); | ||
|
|
||
| // try to open the file for reading | ||
| FILE *fp = fopen(td[i].tfile, "r"); | ||
| if (fp) { | ||
|
|
||
| printf(" Warning: I can read %s\n", td[i].tdir); | ||
| fclose(fp); | ||
| } | ||
| } | ||
| exit(0); | ||
| } | ||
|
|
||
| // wait for the child to finish | ||
| int status; | ||
| wait(&status); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| #ifndef JAILTEST_H | ||
| #define JAILTEST_H | ||
|
|
||
| #include "../include/common.h" | ||
|
|
||
| // main.c | ||
| extern uid_t user_uid; | ||
| extern gid_t user_gid; | ||
| extern char *user_name; | ||
| extern char *user_home_dir; | ||
|
|
||
| // access.c | ||
| void access_setup(const char *directory); | ||
| void access_test(void); | ||
| void access_destroy(void); | ||
|
|
||
| // noexec.c | ||
| void noexec_setup(void); | ||
| void noexec_test(const char *msg); | ||
|
|
||
| // virtual.c | ||
| void virtual_setup(const char *directory); | ||
| void virtual_destroy(void); | ||
| void virtual_test(void); | ||
|
|
||
| // utils.c | ||
| char *get_sudo_user(void); | ||
| char *get_homedir(const char *user, uid_t *uid, gid_t *gid); | ||
| int find_child(pid_t parent, pid_t *child); | ||
| pid_t switch_to_child(pid_t pid); | ||
|
|
||
| #endif |
Oops, something went wrong.