diff options
Diffstat (limited to 'src/firemon/firemon.c')
-rw-r--r-- | src/firemon/firemon.c | 222 |
1 files changed, 222 insertions, 0 deletions
diff --git a/src/firemon/firemon.c b/src/firemon/firemon.c new file mode 100644 index 000000000..d77d11a7a --- /dev/null +++ b/src/firemon/firemon.c | |||
@@ -0,0 +1,222 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014, 2015 netblue30 (netblue30@yahoo.com) | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include "firemon.h" | ||
21 | #include <signal.h> | ||
22 | #include <termios.h> | ||
23 | #include <sys/ioctl.h> | ||
24 | #include <sys/prctl.h> | ||
25 | #include <grp.h> | ||
26 | |||
27 | |||
28 | static int arg_route = 0; | ||
29 | static int arg_arp = 0; | ||
30 | static int arg_tree = 0; | ||
31 | static int arg_interface = 0; | ||
32 | static int arg_seccomp = 0; | ||
33 | static int arg_caps = 0; | ||
34 | static int arg_cpu = 0; | ||
35 | static int arg_cgroup = 0; | ||
36 | int arg_nowrap = 0; | ||
37 | |||
38 | static struct termios tlocal; // startup terminal setting | ||
39 | static struct termios twait; // no wait on key press | ||
40 | static int terminal_set = 0; | ||
41 | |||
42 | static void my_handler(int s){ | ||
43 | if (terminal_set) | ||
44 | tcsetattr(0, TCSANOW, &tlocal); | ||
45 | exit(0); | ||
46 | } | ||
47 | |||
48 | // find the first child process for the specified pid | ||
49 | // return -1 if not found | ||
50 | int find_child(int id) { | ||
51 | int i; | ||
52 | for (i = 0; i < max_pids; i++) { | ||
53 | if (pids[i].level == 2 && pids[i].parent == id) | ||
54 | return i; | ||
55 | } | ||
56 | |||
57 | return -1; | ||
58 | } | ||
59 | |||
60 | // drop privileges | ||
61 | void firemon_drop_privs(void) { | ||
62 | // drop privileges | ||
63 | if (setgroups(0, NULL) < 0) | ||
64 | errExit("setgroups"); | ||
65 | if (setgid(getgid()) < 0) | ||
66 | errExit("setgid/getgid"); | ||
67 | if (setuid(getuid()) < 0) | ||
68 | errExit("setuid/getuid"); | ||
69 | } | ||
70 | |||
71 | // sleep and wait for a key to be pressed | ||
72 | void firemon_sleep(int st) { | ||
73 | if (terminal_set == 0) { | ||
74 | tcgetattr(0, &twait); // get current terminal attirbutes; 0 is the file descriptor for stdin | ||
75 | memcpy(&tlocal, &twait, sizeof(tlocal)); | ||
76 | twait.c_lflag &= ~ICANON; // disable canonical mode | ||
77 | twait.c_lflag &= ~ECHO; // no echo | ||
78 | twait.c_cc[VMIN] = 1; // wait until at least one keystroke available | ||
79 | twait.c_cc[VTIME] = 0; // no timeout | ||
80 | terminal_set = 1; | ||
81 | } | ||
82 | tcsetattr(0, TCSANOW, &twait); | ||
83 | |||
84 | |||
85 | fd_set fds; | ||
86 | FD_ZERO(&fds); | ||
87 | FD_SET(0,&fds); | ||
88 | int maxfd = 1; | ||
89 | |||
90 | struct timeval ts; | ||
91 | ts.tv_sec = st; | ||
92 | ts.tv_usec = 0; | ||
93 | |||
94 | int ready = select(maxfd, &fds, (fd_set *) 0, (fd_set *) 0, &ts); | ||
95 | (void) ready; | ||
96 | if( FD_ISSET(0, &fds)) { | ||
97 | getchar(); | ||
98 | tcsetattr(0, TCSANOW, &tlocal); | ||
99 | printf("\n"); | ||
100 | exit(0); | ||
101 | } | ||
102 | tcsetattr(0, TCSANOW, &tlocal); | ||
103 | } | ||
104 | |||
105 | |||
106 | int main(int argc, char **argv) { | ||
107 | unsigned pid = 0; | ||
108 | int i; | ||
109 | |||
110 | // handle CTRL-C | ||
111 | signal (SIGINT, my_handler); | ||
112 | signal (SIGTERM, my_handler); | ||
113 | |||
114 | for (i = 1; i < argc; i++) { | ||
115 | // default options | ||
116 | if (strcmp(argv[i], "--help") == 0 || | ||
117 | strcmp(argv[i], "-?") == 0) { | ||
118 | usage(); | ||
119 | return 0; | ||
120 | } | ||
121 | else if (strcmp(argv[i], "--version") == 0) { | ||
122 | printf("firemon version %s\n\n", VERSION); | ||
123 | return 0; | ||
124 | } | ||
125 | |||
126 | // options without a pid argument | ||
127 | else if (strcmp(argv[i], "--top") == 0) { | ||
128 | top(); // never to return | ||
129 | } | ||
130 | else if (strcmp(argv[i], "--list") == 0) { | ||
131 | list(); | ||
132 | return 0; | ||
133 | } | ||
134 | else if (strcmp(argv[i], "--netstats") == 0) { | ||
135 | netstats(); | ||
136 | return 0; | ||
137 | } | ||
138 | |||
139 | |||
140 | // cumulative options with or without a pid argument | ||
141 | else if (strcmp(argv[i], "--cgroup") == 0) { | ||
142 | arg_cgroup = 1; | ||
143 | } | ||
144 | else if (strcmp(argv[i], "--cpu") == 0) { | ||
145 | arg_cpu = 1; | ||
146 | } | ||
147 | else if (strcmp(argv[i], "--seccomp") == 0) { | ||
148 | arg_seccomp = 1; | ||
149 | } | ||
150 | else if (strcmp(argv[i], "--caps") == 0) { | ||
151 | arg_caps = 1; | ||
152 | } | ||
153 | else if (strcmp(argv[i], "--tree") == 0) { | ||
154 | arg_tree = 1; | ||
155 | } | ||
156 | else if (strcmp(argv[i], "--interface") == 0) { | ||
157 | arg_interface = 1; | ||
158 | } | ||
159 | else if (strcmp(argv[i], "--route") == 0) { | ||
160 | arg_route = 1; | ||
161 | } | ||
162 | else if (strcmp(argv[i], "--arp") == 0) { | ||
163 | arg_arp = 1; | ||
164 | } | ||
165 | |||
166 | else if (strncmp(argv[i], "--name=", 7) == 0) { | ||
167 | char *name = argv[i] + 7; | ||
168 | if (name2pid(name, (pid_t *) &pid)) { | ||
169 | fprintf(stderr, "Error: cannot find sandbox %s\n", name); | ||
170 | return 1; | ||
171 | } | ||
172 | } | ||
173 | |||
174 | // etc | ||
175 | else if (strcmp(argv[i], "--nowrap") == 0) | ||
176 | arg_nowrap = 1; | ||
177 | |||
178 | // invalid option | ||
179 | else if (*argv[i] == '-') { | ||
180 | fprintf(stderr, "Error: invalid option\n"); | ||
181 | return 1; | ||
182 | } | ||
183 | |||
184 | // PID argument | ||
185 | else { | ||
186 | // this should be a pid number | ||
187 | char *ptr = argv[i]; | ||
188 | while (*ptr != '\0') { | ||
189 | if (!isdigit(*ptr)) { | ||
190 | fprintf(stderr, "Error: not a valid PID number\n"); | ||
191 | exit(1); | ||
192 | } | ||
193 | ptr++; | ||
194 | } | ||
195 | |||
196 | sscanf(argv[i], "%u", &pid); | ||
197 | break; | ||
198 | } | ||
199 | } | ||
200 | |||
201 | if (arg_tree) | ||
202 | tree((pid_t) pid); | ||
203 | if (arg_interface) | ||
204 | interface((pid_t) pid); | ||
205 | if (arg_route) | ||
206 | route((pid_t) pid); | ||
207 | if (arg_arp) | ||
208 | arp((pid_t) pid); | ||
209 | if (arg_seccomp) | ||
210 | seccomp((pid_t) pid); | ||
211 | if (arg_caps) | ||
212 | caps((pid_t) pid); | ||
213 | if (arg_cpu) | ||
214 | cpu((pid_t) pid); | ||
215 | if (arg_cgroup) | ||
216 | cgroup((pid_t) pid); | ||
217 | |||
218 | if (!arg_route && !arg_arp && !arg_interface && !arg_tree && !arg_caps && !arg_seccomp) | ||
219 | procevent((pid_t) pid); // never to return | ||
220 | |||
221 | return 0; | ||
222 | } | ||