matth
/
subgraph-oz
mirror of https://github.com/xSmurf/oz.git
1
1
Fork 0
Code Releases Activity

TENTATIVE: Added support for multiple executable for a single profile - Some minor cleanup

Browse Source
master
xSmurf 9 years ago
parent 8f7e81d5f9
commit 154c8ac5e9
14 changed files with 297 additions and 129 deletions
Show Stats Download Patch File Download Diff File

172
cmd/oz-setup/main.go
Unescape View File

@ -43,6 +43,13 @@ func main() {
},
}
flagsForce := []cli.Flag{
cli.BoolFlag{
Name: "force, f",
Usage: "Force the command to run through non fatal errors",
},
}
app.Commands = []cli.Command{
{
Name: "config",
@ -64,13 +71,13 @@ func main() {
Name: "install",
Usage: "install binary diversion for a program",
Action: handleInstall,
Flags: flagsHookMode,
Flags: append(flagsForce, flagsHookMode...),
},
{
Name: "remove",
Usage: "remove a binary diversion for a program",
Action: handleRemove,
Flags: flagsHookMode,
Flags: append(flagsForce, flagsHookMode...),
},
{
Name: "status",
@ -147,8 +154,8 @@ func handleConfigshow(c *cli.Context) {
fmt.Printf(hfmt, "Config file", "Not found - using defaults")
}
for i := 0; i < len(fmt.Sprintf(sfmt, "", "")); i++ {
fmt.Print("=")
for i := 0; i < len(fmt.Sprintf(sfmt, "", ""))+2; i++ {
fmt.Print("#")
}
fmt.Println("")
@ -180,39 +187,52 @@ func handleInstall(c *cli.Context) {
return // For clarity
}
isInstalled, err := isDivertInstalled(OzProfile.Path)
if err != nil {
fmt.Fprintf(os.Stderr, "Unknown error: %+v\n", err)
os.Exit(1)
}
if isInstalled == true {
fmt.Println("Divert already installed for ", OzProfile.Path)
os.Exit(0)
}
divertInstall := func(cpath string) {
isInstalled, err := isDivertInstalled(cpath)
if err != nil {
fmt.Fprintf(os.Stderr, "Unknown error: %+v\n", err)
os.Exit(1)
}
if isInstalled == true {
fmt.Println("Divert already installed for ", cpath)
if c.Bool("force") {
return
}
os.Exit(0)
}
dpkgArgs := []string{
"--add",
"--package",
"oz",
"--rename",
"--divert",
getBinaryPath(OzProfile.Path),
OzProfile.Path,
}
dpkgArgs := []string{
"--add",
"--package",
"oz",
"--rename",
"--divert",
getBinaryPath(cpath),
cpath,
}
_, err = exec.Command(PathDpkgDivert, dpkgArgs...).Output()
if err != nil {
fmt.Fprintf(os.Stderr, "Dpkg divert command `%s %+s` failed: %s", PathDpkgDivert, dpkgArgs, err)
os.Exit(1)
_, err = exec.Command(PathDpkgDivert, dpkgArgs...).Output()
if err != nil {
fmt.Fprintf(os.Stderr, "Dpkg divert command `%s %+s` failed: %s", PathDpkgDivert, dpkgArgs, err)
os.Exit(1)
}
err = syscall.Symlink(OzConfig.ClientPath, cpath)
if err != nil {
fmt.Fprintf(os.Stderr, "Failed to create symlink %s", err)
os.Exit(1)
}
fmt.Printf("Successfully installed Oz sandbox for: %s.\n", cpath)
}
err = syscall.Symlink(OzConfig.ClientPath, OzProfile.Path)
if err != nil {
fmt.Fprintf(os.Stderr, "Failed to create symlink %s", err)
os.Exit(1)
paths := append([]string{}, OzProfile.Path)
paths = append(paths, OzProfile.Paths...)
for _, pp := range paths {
divertInstall(pp)
}
fmt.Printf("Successfully installed Oz sandbox for: %s.\n", OzProfile.Path)
fmt.Printf("Successfully installed Oz sandbox for: %s.\n", OzProfile.Name)
}
func handleRemove(c *cli.Context) {
@ -229,33 +249,46 @@ func handleRemove(c *cli.Context) {
return // For clarity
}
isInstalled, err := isDivertInstalled(OzProfile.Path)
if err != nil {
fmt.Fprintf(os.Stderr, "Unknown error: %+v\n", err)
os.Exit(1)
}
if isInstalled == false {
fmt.Println("Divert is not installed for ", OzProfile.Path)
os.Exit(0)
}
divertRemove := func(cpath string) {
isInstalled, err := isDivertInstalled(cpath)
if err != nil {
fmt.Fprintf(os.Stderr, "Unknown error: %+v\n", err)
os.Exit(1)
}
if isInstalled == false {
fmt.Println("Divert is not installed for ", cpath)
if c.Bool("force") {
return
}
os.Exit(0)
}
os.Remove(cpath)
dpkgArgs := []string{
"--rename",
"--package",
"oz",
"--remove",
cpath,
}
os.Remove(OzProfile.Path)
_, err = exec.Command(PathDpkgDivert, dpkgArgs...).Output()
if err != nil {
fmt.Fprintf(os.Stderr, "Dpkg divert command `%s %+s` failed: %s", PathDpkgDivert, dpkgArgs, err)
os.Exit(1)
}
dpkgArgs := []string{
"--rename",
"--package",
"oz",
"--remove",
OzProfile.Path,
fmt.Printf("Successfully remove jail for: %s.\n", cpath)
}
_, err = exec.Command(PathDpkgDivert, dpkgArgs...).Output()
if err != nil {
fmt.Fprintf(os.Stderr, "Dpkg divert command `%s %+s` failed: %s", PathDpkgDivert, dpkgArgs, err)
os.Exit(1)
paths := append([]string{}, OzProfile.Path)
paths = append(paths, OzProfile.Paths...)
for _, pp := range paths {
divertRemove(pp)
}
fmt.Printf("Successfully remove jail for: %s.\n", OzProfile.Path)
fmt.Printf("Successfully remove jail for: %s.\n", OzProfile.Name)
}
func handleStatus(c *cli.Context) {
@ -263,7 +296,7 @@ func handleStatus(c *cli.Context) {
pname := c.Args()[0]
OzProfile, err := loadProfile(pname, OzConfig.ProfileDir)
if err != nil || OzProfile == nil {
fmt.Fprintf(os.Stderr, "Unable to load profiles (%s).\n", err)
fmt.Fprintf(os.Stderr, "Unable to load profiles (%s): %v.\n", pname, err)
os.Exit(1)
}
@ -272,17 +305,25 @@ func handleStatus(c *cli.Context) {
os.Exit(1)
}
isInstalled, err := isDivertInstalled(OzProfile.Path)
if err != nil {
fmt.Fprintf(os.Stderr, "Unknown error: %+v\n", err)
os.Exit(1)
}
if isInstalled {
fmt.Println("Package divert is \033[0;32minstalled\033[0m for: ", OzProfile.Path)
} else {
fmt.Println("Package divert is \033[0;31mnot installed\033[0m for: ", OzProfile.Path)
checkInstalled := func(cpath string) {
isInstalled, err := isDivertInstalled(cpath)
if err != nil {
fmt.Fprintf(os.Stderr, "Unknown error: %+v\n", err)
os.Exit(1)
}
sfmt := "%-37s\033[0m%s\n"
if isInstalled {
fmt.Printf("\033[0;32m"+sfmt, "Package divert is installed for: ", cpath)
} else {
fmt.Printf("\033[0;31m"+sfmt, "Package divert is not installed for: ", cpath)
}
}
paths := append([]string{}, OzProfile.Path)
paths = append(paths, OzProfile.Paths...)
for _, pp := range paths {
checkInstalled(pp)
}
}
func handleCreate(c *cli.Context) {
@ -366,10 +407,15 @@ func loadConfig() *oz.Config {
func loadProfile(name, profileDir string) (*oz.Profile, error) {
ps, err := oz.LoadProfiles(profileDir)
if err != nil {
fmt.Println("DERP1")
return nil, err
}
return ps.GetProfileByName(name)
p, err := ps.GetProfileByName(name)
if err != nil || p == nil {
return ps.GetProfileByPath(name)
}
return p, nil
}

12
network/network.go
Unescape View File

@ -18,6 +18,14 @@ const (
ozMaxRandTries = 3
)
type NetType string
const(
TYPE_HOST NetType = "host"
TYPE_EMPTY NetType = "empty"
TYPE_BRIDGE NetType = "bridge"
)
type HostNetwork struct {
// Gateway ip (bridge ip)
Gateway net.IP
@ -35,6 +43,8 @@ type HostNetwork struct {
Max uint64
// Bridge interface MAC Address
BridgeMAC string
//
Nettype NetType
}
type SandboxNetwork struct {
@ -48,6 +58,8 @@ type SandboxNetwork struct {
Gateway net.IP
// IP class (ie: /24)
Class string
//
Nettype NetType
}
var privateNetworkRanges []string

49
network/proxy.go
Unescape View File

@ -10,17 +10,32 @@ import(
"sync"
"github.com/subgraph/oz/ns"
"github.com/op/go-logging"
)
type ProxyType string
const(
PROXY_CLIENT ProxyType = "client"
PROXY_SERVER ProxyType = "server"
)
type ProtoType string
const(
PROTO_TCP ProtoType = "tcp"
PROTO_UDP ProtoType = "udp"
PROTO_SOCKET ProtoType = "socket"
)
// Socket list, used to hold ports that should be forwarded
type ProxyConfig struct {
// One of client, server
Nettype string `json:"type"`
Nettype ProxyType `json:"type"`
// One of tcp, udp, socket
Proto string
Proto ProtoType
// TCP or UDP port number
Port int
@ -40,12 +55,12 @@ var wgProxy sync.WaitGroup
func ProxySetup(childPid int, ozSockets []ProxyConfig, log *logging.Logger, ready sync.WaitGroup) error {
for _, socket := range ozSockets {
if socket.Nettype == "" || socket.Nettype == "client" {
if socket.Nettype == "" || socket.Nettype == PROXY_CLIENT {
err := newProxyClient(childPid, socket.Proto, socket.Destination, socket.Port, log, ready)
if err != nil {
return fmt.Errorf("Unable to setup client socket forwarding %+v, %s", socket, err)
}
} else if socket.Nettype == "server" {
} else if socket.Nettype == PROXY_SERVER {
err := newProxyServer(childPid, socket.Proto, socket.Destination, socket.Port, log, ready)
if err != nil {
return fmt.Errorf("Unable to setup server socket forwarding %+s, %s", socket, err)
@ -59,8 +74,8 @@ func ProxySetup(childPid int, ozSockets []ProxyConfig, log *logging.Logger, read
/**
* Listener/Client
**/
func proxyClientConn(conn *net.Conn, proto, rAddr string, ready sync.WaitGroup) error {
rConn, err := net.Dial(proto, rAddr)
func proxyClientConn(conn *net.Conn, proto ProtoType, rAddr string, ready sync.WaitGroup) error {
rConn, err := net.Dial(string(proto), rAddr)
if err != nil {
return fmt.Errorf("Socket: %+v.\n", err)
}
@ -71,7 +86,7 @@ func proxyClientConn(conn *net.Conn, proto, rAddr string, ready sync.WaitGroup)
return nil
}
func newProxyClient(pid int, proto, dest string, port int, log *logging.Logger, ready sync.WaitGroup) error {
func newProxyClient(pid int, proto ProtoType, dest string, port int, log *logging.Logger, ready sync.WaitGroup) error {
if dest == "" {
dest = "127.0.0.1"
}
@ -104,7 +119,7 @@ func newProxyClient(pid int, proto, dest string, port int, log *logging.Logger,
return nil
}
func proxySocketListener(pid int, proto, lAddr string) (net.Listener, error) {
func proxySocketListener(pid int, proto ProtoType, lAddr string) (net.Listener, error) {
fd, err := ns.OpenProcess(pid, ns.CLONE_NEWNET)
defer ns.Close(fd)
if err != nil {
@ -114,7 +129,7 @@ func proxySocketListener(pid int, proto, lAddr string) (net.Listener, error) {
return nsSocketListener(fd, proto, lAddr)
}
func nsSocketListener(fd uintptr, proto, lAddr string) (net.Listener, error) {
func nsSocketListener(fd uintptr, proto ProtoType, lAddr string) (net.Listener, error) {
origNs, _ := ns.OpenProcess(os.Getpid(), ns.CLONE_NEWNET)
defer ns.Close(origNs)
defer ns.Set(origNs, ns.CLONE_NEWNET)
@ -124,14 +139,14 @@ func nsSocketListener(fd uintptr, proto, lAddr string) (net.Listener, error) {
return nil, err
}
return net.Listen(proto, lAddr)
return net.Listen(string(proto), lAddr)
}
/**
* Connect/Server
**/
func proxyServerConn(pid int, conn *net.Conn, proto, rAddr string, log *logging.Logger, ready sync.WaitGroup) (error) {
func proxyServerConn(pid int, conn *net.Conn, proto ProtoType, rAddr string, log *logging.Logger, ready sync.WaitGroup) (error) {
rConn, err := socketConnect(pid, proto, rAddr)
if err != nil {
log.Error("Socket: %+v.", err)
@ -144,7 +159,7 @@ func proxyServerConn(pid int, conn *net.Conn, proto, rAddr string, log *logging.
return nil
}
func newProxyServer(pid int, proto, dest string, port int, log *logging.Logger, ready sync.WaitGroup) (error) {
func newProxyServer(pid int, proto ProtoType, dest string, port int, log *logging.Logger, ready sync.WaitGroup) (error) {
if dest == "" {
dest = "127.0.0.1"
}
@ -154,7 +169,7 @@ func newProxyServer(pid int, proto, dest string, port int, log *logging.Logger,
log.Info("Starting socket server forwarding: %s://%s.", proto, lAddr)
listen, err := net.Listen(proto, lAddr)
listen, err := net.Listen(string(proto), lAddr)
if err != nil {
return err
}
@ -177,7 +192,7 @@ func newProxyServer(pid int, proto, dest string, port int, log *logging.Logger,
return nil
}
func socketConnect(pid int, proto, rAddr string) (net.Conn, error) {
func socketConnect(pid int, proto ProtoType, rAddr string) (net.Conn, error) {
fd, err := ns.OpenProcess(pid, ns.CLONE_NEWNET)
defer ns.Close(fd)
if err != nil {
@ -187,7 +202,7 @@ func socketConnect(pid int, proto, rAddr string) (net.Conn, error) {
return nsProxySocketConnect(fd, proto, rAddr)
}
func nsProxySocketConnect(fd uintptr, proto, rAddr string) (net.Conn, error) {
func nsProxySocketConnect(fd uintptr, proto ProtoType, rAddr string) (net.Conn, error) {
origNs, _ := ns.OpenProcess(os.Getpid(), ns.CLONE_NEWNET)
defer ns.Close(origNs)
defer ns.Set(origNs, ns.CLONE_NEWNET)
@ -197,6 +212,6 @@ func nsProxySocketConnect(fd uintptr, proto, rAddr string) (net.Conn, error) {
return nil, err
}
return net.Dial(proto, rAddr)
return net.Dial(string(proto), rAddr)
}

3
oz-daemon/client.go
Unescape View File

@ -53,7 +53,7 @@ func ListSandboxes() ([]SandboxInfo, error) {
return body.Sandboxes, nil
}
func Launch(arg string, args, env []string, noexec bool) error {
func Launch(arg, cpath string, args, env []string, noexec bool) error {
idx, name, err := parseProfileArg(arg)
if err != nil {
return err
@ -63,6 +63,7 @@ func Launch(arg string, args, env []string, noexec bool) error {
resp, err := clientSend(&LaunchMsg{
Index: idx,
Name: name,
Path: cpath,
Pwd: pwd,
Args: args,
Env: env,

39
oz-daemon/daemon.go
Unescape View File

@ -71,7 +71,7 @@ func initialize() *daemonState {
d.nextDisplay = 100
for _, pp := range d.profiles {
if pp.Networking.Nettype == "bridge" {
if pp.Networking.Nettype == network.TYPE_BRIDGE {
d.log.Info("Initializing bridge networking")
htn, err := network.BridgeInit(d.config.BridgeMACAddr, d.config.NMIgnoreFile, d.log)
if err != nil {
@ -127,10 +127,11 @@ func (d *daemonState) handleListProfiles(msg *ListProfilesMsg, m *ipc.Message) e
func (d *daemonState) handleLaunch(msg *LaunchMsg, m *ipc.Message) error {
d.Debug("Launch message received: %+v", msg)
p, err := d.getProfileByIdxOrName(msg.Index, msg.Name)
p, err := d.getProfileFromLaunchMsg(msg)
if err != nil {
return m.Respond(&ErrorMsg{err.Error()})
}
if sbox := d.getRunningSandboxByName(p.Name); sbox != nil {
if msg.Noexec {
errmsg := "Asked to launch program but sandbox is running and noexec is set!"
@ -138,12 +139,12 @@ func (d *daemonState) handleLaunch(msg *LaunchMsg, m *ipc.Message) error {
return m.Respond(&ErrorMsg{errmsg})
} else {
d.Info("Found running sandbox for `%s`, running program there", p.Name)
sbox.launchProgram(msg.Pwd, msg.Args, d.log)
sbox.launchProgram(msg.Path, msg.Pwd, msg.Args, d.log)
}
} else {
d.Debug("Would launch %s", p.Name)
env := d.sanitizeEnvironment(p, msg.Env)
_, err = d.launch(p, msg.Pwd, msg.Args, env, msg.Noexec, m.Ucred.Uid, m.Ucred.Gid, d.log)
msg.Env = d.sanitizeEnvironment(p, msg.Env)
_, err = d.launch(p, msg, m.Ucred.Uid, m.Ucred.Gid, d.log)
if err != nil {
d.Warning("Launch of %s failed: %v", p.Name, err)
return m.Respond(&ErrorMsg{err.Error()})
@ -154,7 +155,7 @@ func (d *daemonState) handleLaunch(msg *LaunchMsg, m *ipc.Message) error {
func (d *daemonState) sanitizeEnvironment(p *oz.Profile, oldEnv []string) ([]string) {
newEnv := []string{}
for _, EnvItem := range d.config.EnvironmentVars {
for _, OldItem := range oldEnv {
if strings.HasPrefix(OldItem, EnvItem+"=") {
@ -183,7 +184,7 @@ func (d *daemonState) sanitizeEnvironment(p *oz.Profile, oldEnv []string) ([]str
}
}
}
return newEnv
}
@ -207,6 +208,28 @@ func (d *daemonState) sandboxById(id int) *Sandbox {
return nil
}
func (d *daemonState) getProfileFromLaunchMsg(msg *LaunchMsg) (*oz.Profile, error) {
if msg.Index == 0 && msg.Name == "" {
return d.getProfileByPath(msg.Path)
}
return d.getProfileByIdxOrName(msg.Index, msg.Name)
}
func (d *daemonState) getProfileByPath(cpath string) (*oz.Profile, error) {
for _, p := range d.profiles {
if p.Path == cpath {
return p, nil
}
for _, pp := range p.Paths {
if pp == cpath {
return p, nil
}
}
}
return nil, fmt.Errorf("could not find profile path '%s'", cpath)
}
func (d *daemonState) getProfileByIdxOrName(index int, name string) (*oz.Profile, error) {
if len(name) == 0 {
if index < 1 || index > len(d.profiles) {
@ -229,7 +252,7 @@ func (d *daemonState) getRunningSandboxByName(name string) *Sandbox {
return sb
}
}
return nil
}

35
oz-daemon/launch.go
Unescape View File

@ -36,7 +36,7 @@ type Sandbox struct {
network *network.SandboxNetwork
}
func createInitCommand(initPath, name, chroot string, env []string, uid uint32, display int, stn *network.SandboxNetwork, nettype string) *exec.Cmd {
func createInitCommand(initPath, name, chroot string, env []string, uid uint32, display int, stn *network.SandboxNetwork) *exec.Cmd {
cmd := exec.Command(initPath)
cmd.Dir = "/"
@ -45,7 +45,7 @@ func createInitCommand(initPath, name, chroot string, env []string, uid uint32,
cloneFlags |= syscall.CLONE_NEWPID
cloneFlags |= syscall.CLONE_NEWUTS
if nettype != "host" {
if stn.Nettype != network.TYPE_HOST {
cloneFlags |= syscall.CLONE_NEWNET
}
@ -74,7 +74,7 @@ func createInitCommand(initPath, name, chroot string, env []string, uid uint32,
return cmd
}
func (d *daemonState) launch(p *oz.Profile, pwd string, args, env []string, noexec bool, uid, gid uint32, log *logging.Logger) (*Sandbox, error) {
func (d *daemonState) launch(p *oz.Profile, msg *LaunchMsg, uid, gid uint32, log *logging.Logger) (*Sandbox, error) {
u, err := user.LookupId(fmt.Sprintf("%d", uid))
if err != nil {
return nil, fmt.Errorf("failed to lookup user for uid=%d: %v", uid, err)
@ -84,20 +84,21 @@ func (d *daemonState) launch(p *oz.Profile, pwd string, args, env []string, noex
return nil, err
}
display := 0
if p.XServer.Enabled && p.Networking.Nettype == "host" {
if p.XServer.Enabled && p.Networking.Nettype == network.TYPE_HOST {
display = d.nextDisplay
d.nextDisplay += 1
}
stn := new(network.SandboxNetwork)
if p.Networking.Nettype == "bridge" {
stn.Nettype = p.Networking.Nettype
if p.Networking.Nettype == network.TYPE_BRIDGE {
stn, err = network.PrepareSandboxNetwork(d.network, log)
if err != nil {
return nil, fmt.Errorf("Unable to prepare veth network: %+v", err)
}
}
cmd := createInitCommand(d.config.InitPath, p.Name, fs.Root(), env, uid, display, stn, p.Networking.Nettype)
cmd := createInitCommand(d.config.InitPath, p.Name, fs.Root(), msg.Env, uid, display, stn)
log.Debug("Command environment: %+v", cmd.Env)
pp, err := cmd.StderrPipe()
if err != nil {
@ -124,18 +125,18 @@ func (d *daemonState) launch(p *oz.Profile, pwd string, args, env []string, noex
network: stn,
}
if p.Networking.Nettype == "bridge" {
if p.Networking.Nettype == network.TYPE_BRIDGE {
if err := network.NetInit(stn, d.network, cmd.Process.Pid, log); err != nil {
cmd.Process.Kill()
fs.Cleanup()
return nil, fmt.Errorf("Unable to create veth networking: %+v", err)
}
}
sbox.ready.Add(1)
go sbox.logMessages()
if p.Networking.Nettype != "host" && len(p.Networking.Sockets) > 0 {
if p.Networking.Nettype != network.TYPE_HOST && len(p.Networking.Sockets) > 0 {
go func() {
sbox.ready.Wait()
err := network.ProxySetup(sbox.init.Process.Pid, p.Networking.Sockets, d.log, sbox.ready)
@ -145,10 +146,10 @@ func (d *daemonState) launch(p *oz.Profile, pwd string, args, env []string, noex
}()
}
if !noexec {
if !msg.Noexec {
go func () {
sbox.ready.Wait()
go sbox.launchProgram(pwd, args, log)
go sbox.launchProgram(msg.Path, msg.Pwd, msg.Args, log)
}()
}
@ -158,13 +159,13 @@ func (d *daemonState) launch(p *oz.Profile, pwd string, args, env []string, noex
go sbox.startXpraClient()
}()
}
d.nextSboxId += 1
d.sandboxes = append(d.sandboxes, sbox)
return sbox, nil
}
func (sbox *Sandbox) launchProgram(pwd string, args []string, log *logging.Logger) {
func (sbox *Sandbox) launchProgram(cpath, pwd string, args []string, log *logging.Logger) {
if sbox.profile.AllowFiles {
for _, fpath := range args {
if _, err := os.Stat(fpath); err == nil {
@ -178,8 +179,8 @@ func (sbox *Sandbox) launchProgram(pwd string, args []string, log *logging.Logge
}
}
}
err := ozinit.RunProgram(sbox.addr, pwd, args)
err := ozinit.RunProgram(sbox.addr, cpath, pwd, args)
if err != nil {
log.Error("start shell command failed: %v", err)
}
@ -190,7 +191,7 @@ func (sbox *Sandbox) remove(log *logging.Logger) {
for _, sb := range sbox.daemon.sandboxes {
if sb == sbox {
sb.fs.Cleanup()
if sb.profile.Networking.Nettype == "bridge" {
if sb.profile.Networking.Nettype == network.TYPE_BRIDGE {
sb.network.Cleanup(log)
}
} else {

1
oz-daemon/protocol.go
Unescape View File

@ -32,6 +32,7 @@ type ListProfilesResp struct {
type LaunchMsg struct {
Index int "Launch"
Path string
Name string
Pwd string
Args []string

4
oz-init/client.go
Unescape View File

@ -41,12 +41,12 @@ func Ping(addr string) error {
}
}
func RunProgram(addr, pwd string, args []string) error {
func RunProgram(addr, cpath, pwd string, args []string) error {
c, err := clientConnect(addr)
if err != nil {
return err
}
rr, err := c.ExchangeMsg(&RunProgramMsg{Args: args, Pwd: pwd})
rr, err := c.ExchangeMsg(&RunProgramMsg{Path: cpath, Args: args, Pwd: pwd})
resp := <-rr.Chan()
rr.Done()
c.Close()

33
oz-init/init.go
Unescape View File

@ -4,7 +4,6 @@ import (
"bufio"
"fmt"
"io"
"io/ioutil"
"net"
"os"
"os/exec"
@ -69,8 +68,9 @@ func parseArgs() *initState {
log.Error("oz-init must run as root\n")
os.Exit(1)
}
pcontents, _ := ioutil.ReadFile("/proc/1/cmdline")
if len(pcontents) > 0 {
// We should check that the file contains config.InitPath, but
// since proc is not mounted in this state is still doesn't exist.
if _, err := os.Stat("/proc/1/cmdline"); !os.IsNotExist(err) {
log.Error("What are you doing? Oz-init cannot be launched manually")
os.Exit(1)
}
@ -156,13 +156,13 @@ func parseArgs() *initState {
env = append(env, e)
}
}
env = append(env, "PATH=/usr/bin:/bin")
if p.XServer.Enabled {
env = append(env, "DISPLAY=:"+strconv.Itoa(display))
}
return &initState{
log: log,
config: config,
@ -186,8 +186,8 @@ func (st *initState) runInit() {
if homedir, _ := st.fs.GetHomeDir(); homedir != "" {
st.launchEnv = append(st.launchEnv, "HOME="+homedir)
}
if st.profile.Networking.Nettype != "host" {
if st.profile.Networking.Nettype != network.TYPE_HOST {
err := network.NetSetup(st.network)
if err != nil {
st.log.Error("Unable to setup networking: %+v", err)
@ -289,12 +289,15 @@ func (st *initState) readXpraOutput(r io.ReadCloser) {
}
}
func (st *initState) launchApplication(pwd string, cmdArgs []string) (*exec.Cmd, error) {
func (st *initState) launchApplication(cpath, pwd string, cmdArgs []string) (*exec.Cmd, error) {
suffix := ""
if st.config.DivertSuffix != "" {
suffix = "."+st.config.DivertSuffix
}
cmd := exec.Command(st.profile.Path+suffix)
if cpath == "" {
cpath = st.profile.Path
}
cmd := exec.Command(cpath+suffix)
stdout, err := cmd.StdoutPipe()
if err != nil {
st.log.Warning("Failed to create stdout pipe: %v", err)
@ -311,13 +314,13 @@ func (st *initState) launchApplication(pwd string, cmdArgs []string) (*exec.Cmd,
Gid: uint32(st.gid),
}
cmd.Env = append(cmd.Env, st.launchEnv...)
cmd.Args = append(cmd.Args, cmdArgs...)
if _, err := os.Stat(pwd); err == nil {
cmd.Dir = pwd
}
if err := cmd.Start(); err != nil {
st.log.Warning("Failed to start application (%s): %v", st.profile.Path, err)
return nil, err
@ -326,7 +329,7 @@ func (st *initState) launchApplication(pwd string, cmdArgs []string) (*exec.Cmd,
go st.readApplicationOutput(stdout, "stdout")
go st.readApplicationOutput(stderr, "stderr")
return cmd, nil
}
@ -357,7 +360,7 @@ func handlePing(ping *PingMsg, msg *ipc.Message) error {
func (st *initState) handleRunProgram(rp *RunProgramMsg, msg *ipc.Message) error {
st.log.Info("Run program message received: %+v", rp)
_, err := st.launchApplication(rp.Pwd, rp.Args)
_, err := st.launchApplication(rp.Path, rp.Pwd, rp.Args)
if err != nil {
err := msg.Respond(&ErrorMsg{Msg: err.Error()})
return err

1
oz-init/protocol.go
Unescape View File

@ -21,6 +21,7 @@ type RunShellMsg struct {
type RunProgramMsg struct {
Args []string "RunProgram"
Pwd string
Path string
}
var messageFactory = ipc.NewMsgFactory(

12
oz/main.go
Unescape View File

@ -5,6 +5,7 @@ import (
"io"
"os"
"path"
"path/filepath"
"strconv"
"github.com/subgraph/oz"
@ -41,7 +42,14 @@ func runSandbox() {
os.Exit(1)
}
err := daemon.Launch(runBasename, os.Args[1:], os.Environ(), false)
name := "0"
cpath := os.Args[0]
if !filepath.IsAbs(os.Args[0]) {
// TODO: Check for executable in path...
name = cpath
cpath = ""
}
err := daemon.Launch(name, cpath, os.Args[1:], os.Environ(), false)
if err != nil {
fmt.Fprintf(os.Stderr, "launch command failed: %v.\n", err)
os.Exit(1)
@ -121,7 +129,7 @@ func handleLaunch(c *cli.Context) {
fmt.Println("Argument needed to launch command")
os.Exit(1)
}
err := daemon.Launch(c.Args()[0], c.Args()[1:], os.Environ(), noexec)
err := daemon.Launch(c.Args()[0], "", c.Args()[1:], os.Environ(), noexec)
if err != nil {
fmt.Printf("launch command failed: %v\n", err)
os.Exit(1)

27
profile.go
Unescape View File

@ -5,7 +5,7 @@ import (
"fmt"
"io/ioutil"
"path"
"github.com/subgraph/oz/network"
)
@ -14,6 +14,8 @@ type Profile struct {
Name string
// Path to binary to launch
Path string
// List of path to binaries matching this sandbox
Paths []string
// Path of the config file
ProfilePath string `json:"-"`
// Optional path of binary to watch for watchdog purposes if different than Path
@ -70,7 +72,7 @@ type EnvVar struct {
// Sandbox network definition
type NetworkProfile struct {
// One of empty, host, bridge
Nettype string `json:"type"`
Nettype network.NetType `json:"type"`
// Name of the bridge to attach to
//Bridge string
@ -86,6 +88,20 @@ var loadedProfiles []*Profile
type Profiles []*Profile
func NewDefaultProfile() *Profile {
return &Profile{
Multi: false,
AllowFiles: false,
XServer: XServerConf{
Enabled: true,
EnableTray: false,
UseDBUS: false,
UsePulseAudio: false,
DisableAudio: true,
},
}
}
func (ps Profiles) GetProfileByName(name string) (*Profile, error) {
if loadedProfiles == nil {
ps, err := LoadProfiles(defaultProfileDirectory)
@ -116,6 +132,11 @@ func (ps Profiles) GetProfileByPath(bpath string) (*Profile, error) {
if p.Path == bpath {
return p, nil
}
for _, pp := range p.Paths {
if pp == bpath {
return p, nil
}
}
}
return nil, nil
}
@ -136,7 +157,7 @@ func LoadProfiles(dir string) (Profiles, error) {
ps = append(ps, p)
}
}
loadedProfiles = ps
return ps, nil
}

7
profiles/gajim.json
Unescape View File

@ -1,5 +1,10 @@
{
"path": "/usr/bin/gajim"
"name": "gajim"
, "path": "/usr/bin/gajim"
, "paths": [
"/usr/bin/gajim-history-manager"
, "/usr/bin/gajim-remote"
]
, "xserver": {
"enabled": true
, "enable_tray": true

31
profiles/libreoffice.json
Unescape View File

@ -0,0 +1,31 @@
{
"name": "libreoffice"
, "path": "/usr/bin/libreoffice"
, "paths": [
"/usr/bin/lowriter"
, "/usr/bin/lobase"
, "/usr/bin/localc"
, "/usr/share/libreoffice/bin/lo-xlate-lang"
, "/usr/bin/loffice"
, "/usr/bin/unopkg"
, "/usr/bin/lofromtemplate"
, "/usr/bin/soffice"
, "/usr/bin/lodraw"
, "/usr/bin/loimpress"
, "/usr/bin/lomath"
, "/usr/bin/loweb"
, "/usr/bin/lowriter"
]
, "allow_files": true
, "xserver": {
"enabled": true
, "enable_tray": true
, "tray_icon":"/usr/share/icons/gnome/scalable/apps/libreoffice-startcenter.svg"
, "window_icon":"/usr/share/icons/gnome/scalable/apps/libreoffice-startcenter.svg"
, "disable_audio": true
, "use_pulse_audio": false
}
, "networking":{
"type":"empty"
}
}
Write Preview
Loading…
Cancel
Save