Return to sandbox-rlimit.c CVS log

Up to [local] / src / usr.bin / ssh

Annotation of src/usr.bin/ssh/sandbox-rlimit.c, Revision 1.5

1.5     ! djm         1: /* $OpenBSD: sandbox-rlimit.c,v 1.4 2016/09/12 01:22:38 deraadt Exp $ */
1.1       djm         2: /*
                      3:  * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
                      4:  *
                      5:  * Permission to use, copy, modify, and distribute this software for any
                      6:  * purpose with or without fee is hereby granted, provided that the above
                      7:  * copyright notice and this permission notice appear in all copies.
                      8:  *
                      9:  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
                     10:  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
                     11:  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
                     12:  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
                     13:  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
                     14:  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
                     15:  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
                     16:  */
                     17:
                     18: #include <sys/types.h>
                     19: #include <sys/time.h>
                     20: #include <sys/resource.h>
                     21:
                     22: #include <errno.h>
                     23: #include <stdarg.h>
                     24: #include <stdio.h>
                     25: #include <stdlib.h>
                     26: #include <string.h>
                     27: #include <unistd.h>
                     28:
                     29: #include "log.h"
1.3       djm        30: #include "ssh-sandbox.h"
1.1       djm        31: #include "xmalloc.h"
                     32:
                     33: /* Minimal sandbox that sets zero nfiles, nprocs and filesize rlimits */
                     34:
                     35: struct ssh_sandbox {
                     36:        pid_t child_pid;
                     37: };
                     38:
                     39: struct ssh_sandbox *
                     40: ssh_sandbox_init(void)
                     41: {
                     42:        struct ssh_sandbox *box;
                     43:
                     44:        /*
                     45:         * Strictly, we don't need to maintain any state here but we need
                     46:         * to return non-NULL to satisfy the API.
                     47:         */
1.5     ! djm        48:        debug3_f("preparing rlimit sandbox");
1.1       djm        49:        box = xcalloc(1, sizeof(*box));
                     50:        box->child_pid = 0;
                     51:
                     52:        return box;
                     53: }
                     54:
                     55: void
                     56: ssh_sandbox_child(struct ssh_sandbox *box)
                     57: {
                     58:        struct rlimit rl_zero;
                     59:
                     60:        rl_zero.rlim_cur = rl_zero.rlim_max = 0;
                     61:
                     62:        if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
1.5     ! djm        63:                fatal_f("setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
        !            64:                        strerror(errno));
1.1       djm        65:        if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
1.5     ! djm        66:                fatal_f("setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
        !            67:                        strerror(errno));
1.1       djm        68:        if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
1.5     ! djm        69:                fatal_f("setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
        !            70:                        strerror(errno));
1.1       djm        71: }
                     72:
                     73: void
                     74: ssh_sandbox_parent_finish(struct ssh_sandbox *box)
                     75: {
                     76:        free(box);
1.5     ! djm        77:        debug3_f("finished");
1.1       djm        78: }
                     79:
                     80: void
                     81: ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
                     82: {
                     83:        box->child_pid = child_pid;
                     84:        /* Nothing to do here */
                     85: }
                     86: