Age | Commit message (Collapse) | Author |
|
an environment variable across fork().
This does a couple of things. One is, move the fork/vfork and execl*
functions out of the standard wrapper environment. Having done that,
the execl*() wrappers are rewritten so they can use real_execv*()
when running in antimagic mode.
This allows us to run pseudo entirely in antimagic mode. Which is
handy, because we also add support for enabling/disabling antimagic
mode in the child process on a fork, using an additional hook for
this in the pseudo_client_init() routine. The redone fork() wrapper
now calls pseudo_client_init() in the child process after a
successful fork even if it's in antimagic mode already.
This is not yet well-tested.
|
|
Note that this replaces an existing getxattr() wrapper which canonicalized
pathnames for use in a chroot() environment. The need for that to work
in some possible future may require us to revisit this.
|
|
Current versions of gnu coreutils 'cp' were attempting to set permissions
using fsetxattr. As a workaround, we need to return ENOTSUP so that it falls
back to using fchmod, which pseudo does know how to wrap.
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
|
|
argument -- which turns out to be a problem, as this controls the
canonicalization. The upshot is that some invocations of symlinks
were corrupting $0.
|
|
mknodat() uses a dev_t * argument, not a dev_t argument, so the
0 passed into wrap___xmknodat() by wrap_mkfifoat() is an invalid
argument rather than an unused but valid zero. Change mkfifoat
to create a dummy dev_t and pass its address.
|
|
... Also, make that error message a debugging message, since that's
a normal and legitimate use case.
|
|
flaw in the code. Yes, Virginia, your printf arguments must match
their format strings, and size_t is not the same thing as int.
|
|
in processes started under pseudo.
|
|
bug in the speculative-unlink operation.
The intent is to mark and then confirm or cancel the delete. This
removes the quirk where we tried to stash old database entries,
which didn't handle directories anyway; "rmdir non-empty-directory"
is a bit too common a case to dismiss as unthinkable.
|
|
Fixed a couple of allocation issues, corrected an off-by-one
error in environment setup.
|
|
|
|
|
|
Add local variable cache via get_value and set_value. The local cache
is setup at constructor time (or soon after).
Rewrite the pseudo_setupenv and pseudo_dropenv routines, add a new
pseudo_setupenvp and pseudo_dropenvp as well to handle the execve
cases.
We can now successfully use /usr/bin/env -i env and get pseudo values
back!
|
|
We wrap all of the execs so that we can ensure the environment is
properly configured prior to the exec running.
handle ... for the new execl* wrappers
Add a test for the new execl* ... handling.
|
|
feature.
|
|
In fakechroot, which pseudo tries to match the functionality of,
the default behavior when creating a symlink with an absolute target
is to prepend the chroot path, so that underlying syscalls will
get the right file.
It is necessary to be able to disable this behavior to create target
filesystems in some cases. To that end, support a new environment
variable, PSEUDO_NOSYMLINKEXP, which disables that behavior.
|
|
fgetxattr, since it doesn't use a path name.
|
|
execve() needs to use -1 for both fd and dirfd; the 0 dirfd was
causing various spurious warnings, as well as misidentifying
"exec" as "execat" in client logs.
|
|
Address a couple of compiler warnings, add a couple of signals to the
list of caught signals, etcetera.
|
|
Stop vacuuming the logs database under normal usage -- it's expensive
and slow, and not useful.
Make link(2) "correctly" (following Linux, rather than POSIX) link
to a symlink rather than to the file the symlink links to.
|
|
You can't use setenv() to modify the environment that will
be passed to a child process through execve()...
Also, fix the setupenv() to use PSEUDO_SUFFIX if defined.
Use execve() to spawn child processes, so we can use setupenv()
and dropenv().
|
|
|
|
When you rename across devices, inode can change. Until now,
pseudo had no tools for handling a change in inode, but this
is clearly a legitimate case.
|
|
If multiple clients are active at once, the following could occur:
* Client #1 unlinks file A
* Client #2 creates file B, which reuses A's inode
* Client #2 sends request to server
* Client #1 sends request to server
* Processing client #2's request creates a mismatch warning for
file A/B.
* Processing client #1's request creates a mismatch warning too.
Note that this can happen even if Client #2 sends its request later,
as there's no intrinsic guarantee of the order in which requests
are processed; any SINGLE client is presumably executing operations
in order, but multiple clients aren't.
Fixing this in rmdir, unlink, and rename.
|
|
* Add lckpwdf/ulckpwdf to guts/README
* Remove arguments from function pointer arguments.
While in theory the compar function pointer has always taken
"const struct dirent **", some systems (many) have declared
it instead as taking "const void *". For now, just omit
the types; a pointer to function taking unknown arguments
is a compatible type, and we never call the functions, we
just pass them to something else.
* Handle readlinkat() on systems without *at functions
* Fix pseudo_etc_file (spotted by "fortify")
When O_CREAT can be a flag, 0600 mode is needed. While we're
at it, remove a bogus dummy open.
* Fix mkdtemp()
Was returning the address of the internal buffer rather than the
user-provided buffer. Also fixed a typo in an error message.
* Don't call fgetgrent_r() with a null FILE *.
* A couple of other typo-type fixes.
|
|
It's not enough to rely on the usual chroot() stuff affecting the
file open, not least because these use the glibc-internal __open
which is not currently intercepted, but also because we want to
use the PSEUDO_PASSWD path when that's set but there's no chroot().
There's some extra magic in pseudo_etc_file to support these
operations, since they can legitimately create a file rather
than opening an existing one.
|
|
Moved readlink fixup into a general-purpose function for
removing chroot prefixes.
|
|
Corporate policy is that each module should have a copyright notice.
|
|
Document some limitations of getgroups()/setgroups().
|
|
This is a first pass at handling password/group calls, allowing
the use of custom password/group files. In particular, when
chroot()ed to a particular directory, pseudo picks files in
that directory by default, to improve support for the typical
use case where pseudo uses chroot() only to jump into a virtual
target filesystem.
|
|
This allows us to track execution, although the tracking for it
requires some additional thought -- the basic assumption is that we
don't want to canonicalize names into the chroot() directory, but
since all the filename canonicalization assumes that we want this,
that will take some sneaking. It's a little useful as is, though,
so I'm running with it.
|
|
This patch adds support for checking whether a file was opened for
reading, writing, or both, as well as tracking append flags. It is
not very well tested. This is preparation for improved host
contamination checking.
|
|
None of them seem to have been genuine problems, but it's prettier now,
and some were questionable.
|
|
Not that it changes anything, but by convention we like to
use NULL, not 0, to express a null pointer.
|
|
Add chroot() and a large number of things needed to make it work.
The list of intercepted calls is large but not exhaustive.
|
|
* Improve makewrappers handling of function pointer arguments.
* Regenerate wrappers when makewrappers is touched.
* Move path resolution from pseudo_client_op into wrapper
functions.
* Eliminate dependency on PATH_MAX.
* Related cleanup, such as tracking CWD better, and using
the tracked value for getcwd().
|
|
|