1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
/*
* Copyright (C) 2014-2022 Firejail Authors
*
* This file is part of firejail project
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include "firejail.h"
#include <sys/wait.h>
#include <errno.h>
#define MAXBUF 4096
void save_cgroup(void) {
if (cfg.cgroup == NULL)
return;
FILE *fp = fopen(RUN_CGROUP_CFG, "wxe");
if (fp) {
fprintf(fp, "%s", cfg.cgroup);
fflush(0);
SET_PERMS_STREAM(fp, 0, 0, 0644);
if (fclose(fp))
goto errout;
}
else
goto errout;
return;
errout:
fprintf(stderr, "Error: cannot save cgroup\n");
exit(1);
}
void load_cgroup(const char *fname) {
if (!fname)
return;
FILE *fp = fopen(fname, "re");
if (fp) {
char buf[MAXBUF];
if (fgets(buf, MAXBUF, fp)) {
cfg.cgroup = strdup(buf);
if (!cfg.cgroup)
errExit("strdup");
}
else
goto errout;
fclose(fp);
return;
}
errout:
fwarning("cannot load control group\n");
if (fp)
fclose(fp);
}
static int is_cgroup_path(const char *fname) {
// path starts with /sys/fs/cgroup
if (strncmp(fname, "/sys/fs/cgroup", 14) != 0)
return 0;
// no .. traversal
char *ptr = strstr(fname, "..");
if (ptr)
return 0;
return 1;
}
void check_cgroup_file(const char *fname) {
assert(fname);
invalid_filename(fname, 0); // no globbing
if (!is_cgroup_path(fname))
goto errout;
const char *base = gnu_basename(fname);
if (strcmp(base, "tasks") != 0 && // cgroup v1
strcmp(base, "cgroup.procs") != 0)
goto errout;
if (access(fname, W_OK) == 0)
return;
errout:
fprintf(stderr, "Error: invalid cgroup\n");
exit(1);
}
static void do_set_cgroup(const char *fname, pid_t pid) {
FILE *fp = fopen(fname, "ae");
if (!fp) {
fwarning("cannot open %s for writing: %s\n", fname, strerror(errno));
return;
}
int rv = fprintf(fp, "%d\n", pid);
(void) rv;
fclose(fp);
}
void set_cgroup(const char *fname, pid_t pid) {
pid_t child = fork();
if (child < 0)
errExit("fork");
if (child == 0) {
drop_privs(0);
do_set_cgroup(fname, pid);
_exit(0);
}
waitpid(child, NULL, 0);
}
|