commit f1295a4

Minor rework to sandbox code.

  1@@ -2,32 +2,54 @@
  2 
  3 #include "snac.h"
  4 
  5-#ifdef __linux__
  6-#ifndef WITHOUT_SANDBOX
  7-#include <linux/version.h>
  8+#if defined(__OpenBSD__)
  9 
 10-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 13, 0)
 11-#define WITHOUT_SANDBOX
 12-#endif
 13-#endif
 14-#endif /* __linux__ */
 15+void sbox_enter(const char *basedir)
 16+{
 17+    const char *address = xs_dict_get(srv_config, "address");
 18 
 19+    int smail = !xs_is_true(xs_dict_get(srv_config, "disable_email_notifications"));
 20 
 21-#ifdef WITHOUT_SANDBOX
 22+    if (xs_is_true(xs_dict_get(srv_config, "disable_openbsd_security"))) {
 23+        srv_log(xs_dup("OpenBSD security disabled by admin"));
 24+        return;
 25+    }
 26 
 27-void sbox_enter(const char *basedir)
 28-{
 29-    /* nothing to do */
 30-    (void)basedir;
 31+    srv_debug(1, xs_fmt("Calling unveil()"));
 32+    unveil(basedir,                "rwc");
 33+    unveil("/tmp",                 "rwc");
 34+    unveil("/etc/resolv.conf",     "r");
 35+    unveil("/etc/hosts",           "r");
 36+    unveil("/etc/ssl/openssl.cnf", "r");
 37+    unveil("/etc/ssl/cert.pem",    "r");
 38+    unveil("/usr/share/zoneinfo",  "r");
 39+
 40+    if (smail)
 41+        unveil("/usr/sbin/sendmail",   "x");
 42+
 43+    if (*address == '/')
 44+        unveil(address, "rwc");
 45+
 46+    unveil(NULL,                   NULL);
 47+
 48+    srv_debug(1, xs_fmt("Calling pledge()"));
 49+
 50+    xs *p = xs_str_new("stdio rpath wpath cpath flock inet proc dns fattr");
 51+
 52+    if (smail)
 53+        p = xs_str_cat(p, " exec");
 54+
 55+    if (*address == '/')
 56+        p = xs_str_cat(p, " unix");
 57 
 58-    srv_debug(0, xs_fmt("Linux sandboxing disabled or unsupported"));
 59+    pledge(p, NULL);
 60 }
 61 
 62-#else /* WITHOUT_SANDBOX */
 63+#elif defined(__linux__)
 64 
 65-#include <unistd.h>
 66+#if defined(WITH_LINUX_SANDBOX)
 67 
 68-#if defined (__linux__)
 69+#include <unistd.h>
 70 
 71 #define LL_PRINTERR(fmt, ...) srv_debug(0, xs_fmt(fmt, __VA_ARGS__))
 72 #include "landloc.h"
 73@@ -85,66 +107,42 @@ LL_BEGIN(sbox_enter_linux_, const char* basedir, const char *address, int smail)
 74 
 75 } LL_END
 76 
 77-#endif
 78-
 79 void sbox_enter(const char *basedir)
 80 {
 81     const char *address = xs_dict_get(srv_config, "address");
 82 
 83     int smail = !xs_is_true(xs_dict_get(srv_config, "disable_email_notifications"));
 84 
 85-#if defined (__OpenBSD__)
 86-    if (xs_is_true(xs_dict_get(srv_config, "disable_openbsd_security"))) {
 87-        srv_log(xs_dup("disable_openbsd_security is deprecated. Use disable_sandbox instead."));
 88-        return;
 89-    }
 90     if (xs_is_true(xs_dict_get(srv_config, "disable_sandbox"))) {
 91-        srv_debug(0, xs_dup("Sandbox disabled by admin"));
 92+        srv_debug(1, xs_dup("Linux sandbox disabled by admin"));
 93         return;
 94     }
 95 
 96-    srv_debug(1, xs_fmt("Calling unveil()"));
 97-    unveil(basedir,                "rwc");
 98-    unveil("/tmp",                 "rwc");
 99-    unveil("/etc/resolv.conf",     "r");
100-    unveil("/etc/hosts",           "r");
101-    unveil("/etc/ssl/openssl.cnf", "r");
102-    unveil("/etc/ssl/cert.pem",    "r");
103-    unveil("/usr/share/zoneinfo",  "r");
104-
105-    if (smail)
106-        unveil("/usr/sbin/sendmail",   "x");
107-
108-    if (*address == '/')
109-        unveil(address, "rwc");
110-
111-    unveil(NULL,                   NULL);
112-
113-    srv_debug(1, xs_fmt("Calling pledge()"));
114+    if (sbox_enter_linux_(basedir, address, smail) == 0)
115+        srv_debug(1, xs_dup("Linux sandbox enabled"));
116+    else
117+        srv_debug(1, xs_dup("Linux sandbox failed"));
118+}
119 
120-    xs *p = xs_str_new("stdio rpath wpath cpath flock inet proc dns fattr");
121+#else /* defined(WITH_LINUX_SANDBOX) */
122 
123-    if (smail)
124-        p = xs_str_cat(p, " exec");
125+void sbox_enter(const char *basedir)
126+{
127+    (void)basedir;
128 
129-    if (*address == '/')
130-        p = xs_str_cat(p, " unix");
131+    srv_debug(1, xs_fmt("Linux sandbox not compiled in"));
132+}
133 
134-    pledge(p, NULL);
135+#endif
136 
137-#elif defined (__linux__)
138-    
139-    if (xs_is_true(xs_dict_get_def(srv_config, "disable_sandbox", xs_stock(XSTYPE_TRUE)))) {
140-        srv_debug(0, xs_dup("Sandbox disabled by admin"));
141-        return;
142-    }
143+#else
144 
145-    if (sbox_enter_linux_(basedir, address, smail) == 0)
146-        srv_log(xs_dup("landlocked"));
147-    else
148-        srv_log(xs_dup("landlocking failed"));
149+/* other OSs: dummy sbox_enter() */
150 
151-#endif
152+void sbox_enter(const char *basedir)
153+{
154+    (void)basedir;
155 }
156 
157-#endif /* WITHOUT_SANDBOX */
158+
159+#endif /* __OpenBSD__ */