va_end(args);
}
-static const char * const syscall_tab[] = {
+static void *
+xmalloc(size_t size)
+{
+ void *p = malloc(size);
+ if (!p)
+ die("Out of memory");
+ return p;
+}
+
+static const char * const syscall_names[] = {
#include "syscall-table.h"
};
-#define NUM_SYSCALLS (sizeof(syscall_tab)/sizeof(syscall_tab[0]))
+#define NUM_SYSCALLS ARRAY_SIZE(syscall_names)
#define NUM_ACTIONS (NUM_SYSCALLS+64)
enum action {
static const char *
syscall_name(unsigned int id, char *buf)
{
- if (id < NUM_SYSCALLS && syscall_tab[id])
- return syscall_tab[id];
+ if (id < NUM_SYSCALLS && syscall_names[id])
+ return syscall_names[id];
else
{
sprintf(buf, "#%d", id);
static int
syscall_by_name(char *name)
{
- for (unsigned int i=0; i<sizeof(syscall_tab)/sizeof(syscall_tab[0]); i++)
- if (syscall_tab[i] && !strcmp(syscall_tab[i], name))
+ for (unsigned int i=0; i<NUM_SYSCALLS; i++)
+ if (syscall_names[i] && !strcmp(syscall_names[i], name))
return i;
if (name[0] == '#')
name++;
}
static int
-set_action(char *a)
+set_syscall_action(char *a)
{
char *sep = strchr(a, '=');
enum action act = SC_YES;
int sys = syscall_by_name(a);
if (sys < 0)
die("Unknown syscall `%s'", a);
- if (sys >= (int)NUM_ACTIONS)
+ if (sys >= NUM_ACTIONS)
die("Syscall `%s' out of range", a);
syscall_action[sys] = act;
return 1;
{ "/usr/lib/", SC_YES },
{ "/opt/lib/", SC_YES },
{ "/usr/share/zoneinfo/", SC_YES },
+ { "/usr/share/locale/", SC_YES },
{ "/dev/null", SC_YES },
{ "/dev/zero", SC_YES },
{ "/proc/meminfo", SC_YES },
{ "/proc/self/exe", SC_YES }, // Needed by FPC 2.0.x runtime
};
+static struct path_rule *user_path_rules;
+static struct path_rule **last_path_rule = &user_path_rules;
+
+static int
+set_path_action(char *a)
+{
+ char *sep = strchr(a, '=');
+ enum action act = SC_YES;
+ if (sep)
+ {
+ *sep++ = 0;
+ if (!strcmp(sep, "yes"))
+ act = SC_YES;
+ else if (!strcmp(sep, "no"))
+ act = SC_NO;
+ else
+ return 0;
+ }
+
+ struct path_rule *r = xmalloc(sizeof(*r) + strlen(a));
+ r->path = (char *)(r+1);
+ strcpy(r->path, a);
+ r->action = act;
+ r->next = NULL;
+ *last_path_rule = r;
+ last_path_rule = &r->next;
+ return 1;
+}
+
static enum action
match_path_rule(struct path_rule *r, char *path)
{
if (strstr(namebuf, ".."))
act = SC_NO;
+ // Scan user rules
+ for (struct path_rule *r = user_path_rules; r && !act; r=r->next)
+ act = match_path_rule(r, namebuf);
+
// Scan built-in rules
if (file_access >= 2)
for (int i=0; i<ARRAY_SIZE(default_path_rules) && !act; i++)
-i <file>\tRedirect stdin from <file>\n\
-m <size>\tLimit address space to <size> KB\n\
-o <file>\tRedirect stdout to <file>\n\
+-p <path>\tPermit access to the specified path (or subtree if it ends with a `/')\n\
+-p <path>=<act>\tDefine action for the specified path (<act>=yes/no)\n\
-s <sys>\tPermit the specified syscall (be careful)\n\
-s <sys>=<act>\tDefine action for the specified syscall (<act>=yes/no/file)\n\
-t <time>\tSet run time limit (seconds, fractions allowed)\n\
int c;
uid_t uid;
- while ((c = getopt(argc, argv, "a:c:efi:m:o:s:t:Tvw:")) >= 0)
+ while ((c = getopt(argc, argv, "a:c:efi:m:o:p:s:t:Tvw:")) >= 0)
switch (c)
{
case 'a':
case 'o':
redir_stdout = optarg;
break;
+ case 'p':
+ if (!set_path_action(optarg))
+ usage();
+ break;
case 's':
- if (!set_action(optarg))
+ if (!set_syscall_action(optarg))
usage();
break;
case 't':