Return to sandbox-rlimit.c CVS log

Up to [local] / src / usr.bin / ssh

Annotation of src/usr.bin/ssh/sandbox-rlimit.c, Revision 1.3

1.3     ! djm         1: /* $OpenBSD: sandbox-rlimit.c,v 1.2 2011/06/22 22:14:04 djm Exp $ */
1.1       djm         2: /*
                      3:  * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
                      4:  *
                      5:  * Permission to use, copy, modify, and distribute this software for any
                      6:  * purpose with or without fee is hereby granted, provided that the above
                      7:  * copyright notice and this permission notice appear in all copies.
                      8:  *
                      9:  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
                     10:  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
                     11:  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
                     12:  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
                     13:  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
                     14:  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
                     15:  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
                     16:  */
                     17:
                     18: #include <sys/types.h>
                     19: #include <sys/param.h>
                     20: #include <sys/time.h>
                     21: #include <sys/resource.h>
                     22:
                     23: #include <errno.h>
                     24: #include <stdarg.h>
                     25: #include <stdio.h>
                     26: #include <stdlib.h>
                     27: #include <string.h>
                     28: #include <unistd.h>
                     29:
                     30: #include "log.h"
1.3     ! djm        31: #include "ssh-sandbox.h"
1.1       djm        32: #include "xmalloc.h"
                     33:
                     34: /* Minimal sandbox that sets zero nfiles, nprocs and filesize rlimits */
                     35:
                     36: struct ssh_sandbox {
                     37:        pid_t child_pid;
                     38: };
                     39:
                     40: struct ssh_sandbox *
                     41: ssh_sandbox_init(void)
                     42: {
                     43:        struct ssh_sandbox *box;
                     44:
                     45:        /*
                     46:         * Strictly, we don't need to maintain any state here but we need
                     47:         * to return non-NULL to satisfy the API.
                     48:         */
                     49:        debug3("%s: preparing rlimit sandbox", __func__);
                     50:        box = xcalloc(1, sizeof(*box));
                     51:        box->child_pid = 0;
                     52:
                     53:        return box;
                     54: }
                     55:
                     56: void
                     57: ssh_sandbox_child(struct ssh_sandbox *box)
                     58: {
                     59:        struct rlimit rl_zero;
                     60:
                     61:        rl_zero.rlim_cur = rl_zero.rlim_max = 0;
                     62:
                     63:        if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
                     64:                fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
                     65:                        __func__, strerror(errno));
                     66:        if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
                     67:                fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
                     68:                        __func__, strerror(errno));
                     69:        if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
                     70:                fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
                     71:                        __func__, strerror(errno));
                     72: }
                     73:
                     74: void
                     75: ssh_sandbox_parent_finish(struct ssh_sandbox *box)
                     76: {
                     77:        free(box);
                     78:        debug3("%s: finished", __func__);
                     79: }
                     80:
                     81: void
                     82: ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
                     83: {
                     84:        box->child_pid = child_pid;
                     85:        /* Nothing to do here */
                     86: }
                     87: