diff options
Diffstat (limited to 'src/tools')
-rwxr-xr-x | src/tools/check-caps.sh | 46 | ||||
-rw-r--r-- | src/tools/extract_caps.c | 83 | ||||
-rw-r--r-- | src/tools/extract_syscalls.c | 91 | ||||
-rwxr-xr-x | src/tools/mkcoverit.sh | 45 | ||||
-rw-r--r-- | src/tools/rvtest.c | 144 | ||||
-rw-r--r-- | src/tools/ttytest.c | 36 |
6 files changed, 445 insertions, 0 deletions
diff --git a/src/tools/check-caps.sh b/src/tools/check-caps.sh new file mode 100755 index 000000000..13525677b --- /dev/null +++ b/src/tools/check-caps.sh | |||
@@ -0,0 +1,46 @@ | |||
1 | #!/bin/bash | ||
2 | |||
3 | if [ $# -eq 0 ] | ||
4 | then | ||
5 | echo "Usage: check-caps.sh program-and-arguments" | ||
6 | echo | ||
7 | fi | ||
8 | |||
9 | set -x | ||
10 | |||
11 | firejail --caps.drop=chown "$1" | ||
12 | firejail --caps.drop=dac_override "$1" | ||
13 | firejail --caps.drop=dac_read_search "$1" | ||
14 | firejail --caps.drop=fowner "$1" | ||
15 | firejail --caps.drop=fsetid "$1" | ||
16 | firejail --caps.drop=kill "$1" | ||
17 | firejail --caps.drop=setgid "$1" | ||
18 | firejail --caps.drop=setuid "$1" | ||
19 | firejail --caps.drop=setpcap "$1" | ||
20 | firejail --caps.drop=linux_immutable "$1" | ||
21 | firejail --caps.drop=net_bind_service "$1" | ||
22 | firejail --caps.drop=net_broadcast "$1" | ||
23 | firejail --caps.drop=net_admin "$1" | ||
24 | firejail --caps.drop=net_raw "$1" | ||
25 | firejail --caps.drop=ipc_lock "$1" | ||
26 | firejail --caps.drop=ipc_owner "$1" | ||
27 | firejail --caps.drop=sys_module "$1" | ||
28 | firejail --caps.drop=sys_rawio "$1" | ||
29 | firejail --caps.drop=sys_chroot "$1" | ||
30 | firejail --caps.drop=sys_ptrace "$1" | ||
31 | firejail --caps.drop=sys_pacct "$1" | ||
32 | firejail --caps.drop=sys_admin "$1" | ||
33 | firejail --caps.drop=sys_boot "$1" | ||
34 | firejail --caps.drop=sys_nice "$1" | ||
35 | firejail --caps.drop=sys_resource "$1" | ||
36 | firejail --caps.drop=sys_time "$1" | ||
37 | firejail --caps.drop=sys_tty_config "$1" | ||
38 | firejail --caps.drop=mknod "$1" | ||
39 | firejail --caps.drop=lease "$1" | ||
40 | firejail --caps.drop=audit_write "$1" | ||
41 | firejail --caps.drop=audit_control "$1" | ||
42 | firejail --caps.drop=setfcap "$1" | ||
43 | firejail --caps.drop=mac_override "$1" | ||
44 | firejail --caps.drop=mac_admin "$1" | ||
45 | firejail --caps.drop=syslog "$1" | ||
46 | firejail --caps.drop=wake_alarm "$1" | ||
diff --git a/src/tools/extract_caps.c b/src/tools/extract_caps.c new file mode 100644 index 000000000..94a062ccb --- /dev/null +++ b/src/tools/extract_caps.c | |||
@@ -0,0 +1,83 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014, 2015 netblue30 (netblue30@yahoo.com) | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include <stdio.h> | ||
21 | #include <stdlib.h> | ||
22 | #include <string.h> | ||
23 | #include <assert.h> | ||
24 | |||
25 | #define BUFMAX 4096 | ||
26 | |||
27 | int main(int argc, char **argv) { | ||
28 | if (argc != 2) { | ||
29 | printf("usage: %s /usr/include/linux/capability.h\n", argv[0]); | ||
30 | return 1; | ||
31 | } | ||
32 | |||
33 | //open file | ||
34 | FILE *fp = fopen(argv[1], "r"); | ||
35 | if (!fp) { | ||
36 | fprintf(stderr, "Error: cannot open file\n"); | ||
37 | return 1; | ||
38 | } | ||
39 | |||
40 | // read file | ||
41 | char buf[BUFMAX]; | ||
42 | while (fgets(buf, BUFMAX, fp)) { | ||
43 | // cleanup | ||
44 | char *start = buf; | ||
45 | while (*start == ' ' || *start == '\t') | ||
46 | start++; | ||
47 | char *end = strchr(start, '\n'); | ||
48 | if (end) | ||
49 | *end = '\0'; | ||
50 | |||
51 | // parsing | ||
52 | if (strncmp(start, "#define CAP_", 12) == 0) { | ||
53 | if (strstr(start, "CAP_LAST_CAP")) | ||
54 | break; | ||
55 | |||
56 | char *ptr1 = start + 8; | ||
57 | char *ptr2 = ptr1; | ||
58 | while (*ptr2 == ' ' || *ptr2 == '\t') | ||
59 | ptr2++; | ||
60 | while (*ptr2 != ' ' && *ptr2 != '\t') | ||
61 | ptr2++; | ||
62 | *ptr2 = '\0'; | ||
63 | |||
64 | ptr2 = strdup(ptr1); | ||
65 | assert(ptr2); | ||
66 | ptr2 += 4; | ||
67 | char *ptr3 = ptr2; | ||
68 | while (*ptr3 != '\0') { | ||
69 | *ptr3 = tolower(*ptr3); | ||
70 | ptr3++; | ||
71 | } | ||
72 | |||
73 | |||
74 | printf("#ifdef %s\n", ptr1); | ||
75 | printf("\t{\"%s\", %s },\n", ptr2, ptr1); | ||
76 | printf("#endif\n"); | ||
77 | |||
78 | } | ||
79 | |||
80 | } | ||
81 | fclose(fp); | ||
82 | return 0; | ||
83 | } | ||
diff --git a/src/tools/extract_syscalls.c b/src/tools/extract_syscalls.c new file mode 100644 index 000000000..0e064a49e --- /dev/null +++ b/src/tools/extract_syscalls.c | |||
@@ -0,0 +1,91 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014, 2015 netblue30 (netblue30@yahoo.com) | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include <stdio.h> | ||
21 | #include <stdlib.h>6 | ||
22 | #include <string.h> | ||
23 | |||
24 | #define BUFMAX 4096 | ||
25 | |||
26 | int main(int argc, char **argv) { | ||
27 | if (argc != 2) { | ||
28 | printf("usage: %s /media/ubuntu/usr/include/x86_64-linux-gnu/bits/syscall.h\n", argv[0]); | ||
29 | return 1; | ||
30 | } | ||
31 | |||
32 | //open file | ||
33 | FILE *fp = fopen(argv[1], "r"); | ||
34 | if (!fp) { | ||
35 | fprintf(stderr, "Error: cannot open file\n"); | ||
36 | return 1; | ||
37 | } | ||
38 | |||
39 | // read file | ||
40 | char buf[BUFMAX]; | ||
41 | while (fgets(buf, BUFMAX, fp)) { | ||
42 | // cleanup | ||
43 | char *start = buf; | ||
44 | while (*start == ' ' || *start == '\t') | ||
45 | start++; | ||
46 | char *end = strchr(start, '\n'); | ||
47 | if (end) | ||
48 | *end = '\0'; | ||
49 | |||
50 | // parsing | ||
51 | if (strncmp(start, "#endif", 6) == 0) | ||
52 | printf("%s\n", start); | ||
53 | if (strncmp(start, "#endif", 6) == 0) | ||
54 | printf("%s\n", start); | ||
55 | else if (strncmp(start, "#if", 3) == 0) | ||
56 | printf("%s\n", start); | ||
57 | else if (strncmp(start, "#define", 7) == 0) { | ||
58 | // extract data | ||
59 | char *ptr1 = strstr(start, "SYS_"); | ||
60 | char *ptr2 = strstr(start, "__NR_"); | ||
61 | if (!ptr1 || !ptr2) { | ||
62 | fprintf(stderr, "Error: cannot parse \"%s\"\n", start); | ||
63 | fclose(fp); | ||
64 | return 1; | ||
65 | } | ||
66 | *(ptr2 - 1) = '\0'; | ||
67 | |||
68 | char *ptr3 = ptr1; | ||
69 | while (*ptr3 != ' ' && *ptr3 != '\t' && *ptr3 != '\0') | ||
70 | ptr3++; | ||
71 | *ptr3 = '\0'; | ||
72 | ptr3 = ptr2; | ||
73 | while (*ptr3 != ' ' && *ptr3 != '\t' && *ptr3 != '\0') | ||
74 | ptr3++; | ||
75 | *ptr3 = '\0'; | ||
76 | |||
77 | ptr3 = ptr1; | ||
78 | while (*ptr3 != '_') | ||
79 | ptr3++; | ||
80 | ptr3++; | ||
81 | |||
82 | printf("#ifdef %s\n", ptr1); | ||
83 | printf("#ifdef %s\n", ptr2); | ||
84 | printf("\t{\"%s\", %s},\n", ptr3, ptr2); | ||
85 | printf("#endif\n"); | ||
86 | printf("#endif\n"); | ||
87 | } | ||
88 | } | ||
89 | fclose(fp); | ||
90 | return 0; | ||
91 | } | ||
diff --git a/src/tools/mkcoverit.sh b/src/tools/mkcoverit.sh new file mode 100755 index 000000000..4af84a7a1 --- /dev/null +++ b/src/tools/mkcoverit.sh | |||
@@ -0,0 +1,45 @@ | |||
1 | #!/bin/bash | ||
2 | |||
3 | # unpack firejail archive | ||
4 | ARCFIREJAIL=`ls *.tar.bz2| grep firejail` | ||
5 | if [ "$?" -eq 0 ]; | ||
6 | then | ||
7 | echo "preparing $ARCFIREJAIL" | ||
8 | DIRFIREJAIL=`basename $ARCFIREJAIL .tar.bz2` | ||
9 | rm -fr $DIRFIREJAIL | ||
10 | tar -xjvf $ARCFIREJAIL | ||
11 | cd $DIRFIREJAIL | ||
12 | ./configure --prefix=/usr | ||
13 | cd .. | ||
14 | else | ||
15 | echo "Error: firejail source archive missing" | ||
16 | exit 1 | ||
17 | fi | ||
18 | |||
19 | |||
20 | # unpack firetools archive | ||
21 | ARCFIRETOOLS=`ls *.tar.bz2 | grep firetools` | ||
22 | if [ "$?" -eq 0 ]; | ||
23 | then | ||
24 | echo "preparing $ARCFIRETOOLS" | ||
25 | DIRFIRETOOLS=`basename $ARCFIRETOOLS .tar.bz2` | ||
26 | rm -fr $DIRFIRETOOLS | ||
27 | tar -xjvf $ARCFIRETOOLS | ||
28 | cd $DIRFIRETOOLS | ||
29 | pwd | ||
30 | ./configure --prefix=/usr | ||
31 | cd .. | ||
32 | |||
33 | else | ||
34 | echo "Error: firetools source archive missing" | ||
35 | exit 1 | ||
36 | fi | ||
37 | |||
38 | # move firetools in firejail source tree | ||
39 | mkdir -p $DIRFIREJAIL/extras | ||
40 | mv $DIRFIRETOOLS $DIRFIREJAIL/extras/firetools | ||
41 | |||
42 | # build | ||
43 | cd $DIRFIREJAIL | ||
44 | cov-build --dir cov-int make -j 4 extras | ||
45 | tar czvf myproject.tgz cov-int | ||
diff --git a/src/tools/rvtest.c b/src/tools/rvtest.c new file mode 100644 index 000000000..95050e671 --- /dev/null +++ b/src/tools/rvtest.c | |||
@@ -0,0 +1,144 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014, 2015 netblue30 (netblue30@yahoo.com) | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | |||
21 | // run it as "rvtest 2>/dev/null | grep TESTING" | ||
22 | |||
23 | #include <stdio.h> | ||
24 | #include <stdlib.h> | ||
25 | #include <unistd.h> | ||
26 | #include <string.h> | ||
27 | #include <sys/types.h> | ||
28 | #include <signal.h> | ||
29 | |||
30 | #define MAXBUF 1024 // line buffer | ||
31 | #define TIMEOUT 30 // timeout time in seconds | ||
32 | |||
33 | static pid_t pid; | ||
34 | static void catch_alarm(int sig) { | ||
35 | kill(pid, SIGTERM); | ||
36 | sleep(1); | ||
37 | kill(pid, SIGKILL); | ||
38 | printf("TESTING ERROR: SIGALARM triggered\n"); | ||
39 | exit(1); | ||
40 | } | ||
41 | |||
42 | static void usage(void) { | ||
43 | printf("Usage: rvtest testfile\n"); | ||
44 | printf("\n"); | ||
45 | printf("Testfile format:\n"); | ||
46 | printf("\tretval command\n"); | ||
47 | printf("\n"); | ||
48 | printf("Testfile example:\n"); | ||
49 | printf("\n"); | ||
50 | printf("0 firejail --net=none exit\n"); | ||
51 | printf("1 firejail --private=/etc sleep 1\n"); | ||
52 | printf("1 firejail --blablabla\n"); | ||
53 | } | ||
54 | |||
55 | int main(int argc, char **argv) { | ||
56 | if (argc != 2) { | ||
57 | fprintf(stderr, "Error: test file missing\n"); | ||
58 | usage(); | ||
59 | return 1; | ||
60 | } | ||
61 | |||
62 | signal (SIGALRM, catch_alarm); | ||
63 | |||
64 | // open test file | ||
65 | char *fname = argv[1]; | ||
66 | FILE *fp = fopen(fname, "r"); | ||
67 | |||
68 | // read test file | ||
69 | char buf[MAXBUF]; | ||
70 | int line = 0; | ||
71 | while (fgets(buf, MAXBUF, fp)) { | ||
72 | line++; | ||
73 | // skip blanks | ||
74 | char *start = buf; | ||
75 | while (*start == ' ' || *start == '\t') | ||
76 | start++; | ||
77 | // remove '\n' | ||
78 | char *ptr = strchr(start, '\n'); | ||
79 | if (ptr) | ||
80 | *ptr ='\0'; | ||
81 | if (*start == '\0') | ||
82 | continue; | ||
83 | |||
84 | // skip comments | ||
85 | if (*start == '#') | ||
86 | continue; | ||
87 | ptr = strchr(start, '#'); | ||
88 | if (ptr) | ||
89 | *ptr = '\0'; | ||
90 | |||
91 | // extract exit status | ||
92 | int status; | ||
93 | int rv = sscanf(start, "%d\n", &status); | ||
94 | if (rv != 1) { | ||
95 | fprintf(stderr, "Error: invalid line %d in %s\n", line, fname); | ||
96 | exit(1); | ||
97 | } | ||
98 | |||
99 | // extract command | ||
100 | char *cmd = strchr(start, ' '); | ||
101 | if (!cmd) { | ||
102 | fprintf(stderr, "Error: invalid line %d in %s\n", line, fname); | ||
103 | exit(1); | ||
104 | } | ||
105 | |||
106 | // execute command | ||
107 | printf("TESTING %s\n", cmd); | ||
108 | fflush(0); | ||
109 | pid = fork(); | ||
110 | if (pid == -1) { | ||
111 | perror("fork"); | ||
112 | exit(1); | ||
113 | } | ||
114 | |||
115 | // child | ||
116 | if (pid == 0) { | ||
117 | char *earg[50]; | ||
118 | earg[0] = "/bin/bash"; | ||
119 | earg[1] = "-c"; | ||
120 | earg[2] = cmd; | ||
121 | earg[3] = NULL; | ||
122 | execvp(earg[0], earg); | ||
123 | } | ||
124 | // parent | ||
125 | else { | ||
126 | int exit_status; | ||
127 | |||
128 | alarm(TIMEOUT); | ||
129 | pid = waitpid(pid, &exit_status, 0); | ||
130 | if (pid == -1) { | ||
131 | perror("waitpid"); | ||
132 | exit(1); | ||
133 | } | ||
134 | |||
135 | if (WEXITSTATUS(exit_status) != status) | ||
136 | printf("ERROR TESTING: %s\n", cmd); | ||
137 | } | ||
138 | |||
139 | fflush(0); | ||
140 | } | ||
141 | fclose(fp); | ||
142 | |||
143 | return 0; | ||
144 | } \ No newline at end of file | ||
diff --git a/src/tools/ttytest.c b/src/tools/ttytest.c new file mode 100644 index 000000000..a449bf9ba --- /dev/null +++ b/src/tools/ttytest.c | |||
@@ -0,0 +1,36 @@ | |||
1 | #define _XOPEN_SOURCE 600 | ||
2 | #include <stdlib.h> | ||
3 | #include <stdio.h> | ||
4 | #include <fcntl.h> | ||
5 | #include <errno.h> | ||
6 | |||
7 | int main(void) { | ||
8 | int fdm; | ||
9 | int rc; | ||
10 | |||
11 | // initial | ||
12 | system("ls -l /dev/pts"); | ||
13 | |||
14 | fdm = posix_openpt(O_RDWR); | ||
15 | if (fdm < 0) { | ||
16 | perror("posix_openpt"); | ||
17 | return 1; | ||
18 | } | ||
19 | |||
20 | rc = grantpt(fdm); | ||
21 | if (rc != 0) { | ||
22 | perror("grantpt"); | ||
23 | return 1; | ||
24 | } | ||
25 | |||
26 | rc = unlockpt(fdm); | ||
27 | if (rc != 0) { | ||
28 | perror("unlockpt"); | ||
29 | return 1; | ||
30 | } | ||
31 | |||
32 | // final | ||
33 | system("ls -l /dev/pts"); | ||
34 | |||
35 | return 0; | ||
36 | } | ||