matth
/
subgraph-oz
mirror of https://github.com/xSmurf/oz.git
1
1
Fork 0
Code Releases Activity

Don't barf on missing blacklist items, cleanup of makedev mode setting

Browse Source
master
xSmurf 10 years ago
parent b9aba84682
commit d4113399e3
2 changed files with 21 additions and 22 deletions
Show Stats Download Patch File Download Diff File

9
fs/fs.go
Unescape View File

@ -51,14 +51,13 @@ func (fs *Filesystem) CreateEmptyDir(target string) error {
return copyFileInfo(fi, target) return copyFileInfo(fi, target)
} }
func (fs *Filesystem) CreateDevice(devpath string, dev int, mode, perm uint32) error { func (fs *Filesystem) CreateDevice(devpath string, dev int, mode uint32) error {
p := fs.absPath(devpath) p := fs.absPath(devpath)
um := syscall.Umask(0)
if err := syscall.Mknod(p, mode, dev); err != nil { if err := syscall.Mknod(p, mode, dev); err != nil {
return fmt.Errorf("failed to mknod device '%s': %v", p, err) return fmt.Errorf("failed to mknod device '%s': %v", p, err)
} }
if err := os.Chmod(p, os.FileMode(perm)); err != nil { syscall.Umask(um)
return fmt.Errorf("unable to set file permissions on device '%s': %v", p, err)
}
return nil return nil
} }
@ -196,7 +195,7 @@ func readSourceInfo(src string, cancreate bool, u *user.User) (os.FileInfo, erro
func (fs *Filesystem) BlacklistPath(target string, u *user.User) error { func (fs *Filesystem) BlacklistPath(target string, u *user.User) error {
ps, err := resolvePath(target, u) ps, err := resolvePath(target, u)
if err != nil { if err != nil {
return err return nil
} }
for _, p := range ps { for _, p := range ps {
if err := fs.blacklist(p); err != nil { if err := fs.blacklist(p); err != nil {

34
oz-daemon/rootfs.go
Unescape View File

@ -38,17 +38,17 @@ var deviceSymlinks = [][2]string{
} }
var basicBlacklist = []string{ var basicBlacklist = []string{
"/usr/sbin", "/sbin", "${PATH}/su", "/usr/sbin", "/sbin", "/etc/X11",
"${PATH}/sudo", "${PATH}/fusermount", "${PATH}/sudo", "${PATH}/su",
"${PATH}/xinput", "${PATH}/strace", "${PATH}/xinput", "${PATH}/strace",
"${PATH}/mount", "${PATH}/umount", "${PATH}/mount", "${PATH}/umount",
"${PATH}/fusermount",
} }
type fsDeviceDefinition struct { type fsDeviceDefinition struct {
path string path string
mode uint32 mode uint32
dev int dev int
perm uint32
} }
const ugorw = syscall.S_IRUSR | syscall.S_IWUSR | syscall.S_IRGRP | syscall.S_IWGRP | syscall.S_IROTH | syscall.S_IWOTH const ugorw = syscall.S_IRUSR | syscall.S_IWUSR | syscall.S_IRGRP | syscall.S_IWGRP | syscall.S_IROTH | syscall.S_IWOTH
@ -56,19 +56,19 @@ const urwgr = syscall.S_IRUSR | syscall.S_IWUSR | syscall.S_IRGRP
const urw = syscall.S_IRUSR | syscall.S_IWUSR const urw = syscall.S_IRUSR | syscall.S_IWUSR
var basicDevices = []fsDeviceDefinition{ var basicDevices = []fsDeviceDefinition{
{path: "/dev/full", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 7), perm: 0666}, {path: "/dev/full", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 7)},
{path: "/dev/null", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 3), perm: 0666}, {path: "/dev/null", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 3)},
{path: "/dev/random", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 8), perm: 0666}, {path: "/dev/random", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 8)},
{path: "/dev/console", mode: syscall.S_IFCHR | urw, dev: _makedev(5, 1), perm: 0600}, {path: "/dev/console", mode: syscall.S_IFCHR | urw, dev: _makedev(5, 1)},
{path: "/dev/tty", mode: syscall.S_IFCHR | ugorw, dev: _makedev(5, 0), perm: 0666}, {path: "/dev/tty", mode: syscall.S_IFCHR | ugorw, dev: _makedev(5, 0)},
{path: "/dev/tty1", mode: syscall.S_IFREG | urwgr, dev: 0, perm: 0640}, {path: "/dev/tty1", mode: syscall.S_IFREG | urwgr, dev: 0},
{path: "/dev/tty2", mode: syscall.S_IFREG | urwgr, dev: 0, perm: 0640}, {path: "/dev/tty2", mode: syscall.S_IFREG | urwgr, dev: 0},
{path: "/dev/tty3", mode: syscall.S_IFREG | urwgr, dev: 0, perm: 0640}, {path: "/dev/tty3", mode: syscall.S_IFREG | urwgr, dev: 0},
{path: "/dev/tty4", mode: syscall.S_IFREG | urwgr, dev: 0, perm: 0640}, {path: "/dev/tty4", mode: syscall.S_IFREG | urwgr, dev: 0},
{path: "/dev/urandom", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 9), perm: 0666}, {path: "/dev/urandom", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 9)},
{path: "/dev/zero", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 5), perm: 0666}, {path: "/dev/zero", mode: syscall.S_IFCHR | ugorw, dev: _makedev(1, 5)},
} }
func _makedev(x, y int) int { func _makedev(x, y int) int {
@ -111,7 +111,7 @@ func setupRootfs(fsys *fs.Filesystem) error {
} }
for _, d := range basicDevices { for _, d := range basicDevices {
if err := fsys.CreateDevice(d.path, d.dev, d.mode, d.perm); err != nil { if err := fsys.CreateDevice(d.path, d.dev, d.mode); err != nil {
return err return err
} }
} }

Write Preview
Loading…
Cancel
Save