diff options
| -rw-r--r-- | src/core/capsicum.c | 33 | ||||
| -rw-r--r-- | src/core/capsicum.h | 1 | ||||
| -rw-r--r-- | src/core/log.c | 15 | ||||
| -rw-r--r-- | src/core/log.h | 2 | ||||
| -rw-r--r-- | src/core/network.c | 1 | ||||
| -rw-r--r-- | src/core/rawlog.c | 17 |
6 files changed, 65 insertions, 4 deletions
diff --git a/src/core/capsicum.c b/src/core/capsicum.c index 5a59adcd..6667276c 100644 --- a/src/core/capsicum.c +++ b/src/core/capsicum.c @@ -20,6 +20,8 @@ #include "module.h" #include "commands.h" +#include "log.h" +#include "misc.h" #include "network.h" #include "settings.h" #include "signals.h" @@ -34,6 +36,9 @@ #define OPCODE_CONNECT 1 #define OPCODE_GETHOSTBYNAME 2 +static char *irclogs_path; +static size_t irclogs_path_len; +static int irclogs_fd; static int symbiontfds[2]; gboolean capsicum_enabled(void) @@ -127,6 +132,23 @@ int capsicum_net_gethostbyname(const char *addr, IPADDR *ip4, IPADDR *ip6) return ret; } +int capsicum_open(const char *path, int flags, int mode) +{ + int fd; + + /* +1 is for slash separating irclogs_path and the rest. */ + if (strlen(path) > irclogs_path_len + 1 && strncmp(path, irclogs_path, irclogs_path_len) == 0) { + fd = openat(irclogs_fd, path + irclogs_path_len + 1, flags, mode); + } else { + fd = open(path, flags, mode); + } + + if (fd < 0 && (errno == ENOTCAPABLE || errno == ECAPMODE)) + g_warning("File system access restricted to %s due to capability mode", irclogs_path); + + return (fd); +} + nvlist_t *symbiont_connect(const nvlist_t *request) { nvlist_t *response; @@ -261,6 +283,16 @@ static void cmd_capsicum_enter(void) return; } + irclogs_path = convert_home(settings_get_str("capsicum_irclogs_path")); + g_mkdir_with_parents(irclogs_path, log_dir_create_mode); + irclogs_path_len = strlen(irclogs_path); + irclogs_fd = open(irclogs_path, O_DIRECTORY | O_CLOEXEC); + if (irclogs_fd < 0) { + g_warning("Unable to open %s: %s", irclogs_path, strerror(errno)); + signal_emit("capability mode failed", 1, strerror(errno)); + return; + } + error = start_symbiont(); if (error != 0) { signal_emit("capability mode failed", 1, strerror(errno)); @@ -299,6 +331,7 @@ void sig_init_finished(void) void capsicum_init(void) { settings_add_bool("misc", "capsicum", FALSE); + settings_add_str("misc", "capsicum_irclogs_path", "~/irclogs"); signal_add("irssi init finished", (SIGNAL_FUNC) sig_init_finished); diff --git a/src/core/capsicum.h b/src/core/capsicum.h index 2733c1ea..ca35fd05 100644 --- a/src/core/capsicum.h +++ b/src/core/capsicum.h @@ -4,6 +4,7 @@ gboolean capsicum_enabled(void); int capsicum_net_connect_ip(IPADDR *ip, int port, IPADDR *my_ip); int capsicum_net_gethostbyname(const char *addr, IPADDR *ip4, IPADDR *ip6); +int capsicum_open(const char *path, int flags, int mode); void capsicum_init(void); void capsicum_deinit(void); diff --git a/src/core/log.c b/src/core/log.c index cee1dab5..00686bee 100644 --- a/src/core/log.c +++ b/src/core/log.c @@ -26,6 +26,9 @@ #include "servers.h" #include "log.h" #include "write-buffer.h" +#ifdef HAVE_CAPSICUM +#include "capsicum.h" +#endif #include "lib-config/iconfig.h" #include "settings.h" @@ -73,6 +76,16 @@ static void log_write_timestamp(int handle, const char *format, if (text != NULL) write_buffer(handle, text, strlen(text)); } +static int log_open_wrapper(const char *path, int flags, int mode) +{ +#ifdef HAVE_CAPSICUM + if (capsicum_enabled()) + return capsicum_open(path, flags, mode); +#endif + + return open(path, flags, mode); +} + static char *log_filename(LOG_REC *log) { char *str, fname[1024]; @@ -119,7 +132,7 @@ int log_start_logging(LOG_REC *log) } log->handle = log->real_fname == NULL ? -1 : - open(log->real_fname, O_WRONLY | O_APPEND | O_CREAT, + log_open_wrapper(log->real_fname, O_WRONLY | O_APPEND | O_CREAT, log_file_create_mode); if (log->handle == -1) { signal_emit("log create failed", 1, log); diff --git a/src/core/log.h b/src/core/log.h index 5a07859b..52660bb9 100644 --- a/src/core/log.h +++ b/src/core/log.h @@ -38,6 +38,8 @@ extern GSList *logs; extern int log_file_create_mode; extern int log_dir_create_mode; +extern int log_dir_create_mode; + /* Create log record - you still need to call log_update() to actually add it into log list */ LOG_REC *log_create_rec(const char *fname, int level); diff --git a/src/core/network.c b/src/core/network.c index 01e56eb5..4494dbc6 100644 --- a/src/core/network.c +++ b/src/core/network.c @@ -198,7 +198,6 @@ int net_connect_ip_handle(const IPADDR *ip, int port, const IPADDR *my_ip) return handle; } - /* Connect to socket with ip address */ GIOChannel *net_connect_ip(IPADDR *ip, int port, IPADDR *my_ip) { diff --git a/src/core/rawlog.c b/src/core/rawlog.c index 2ec155fa..5df02981 100644 --- a/src/core/rawlog.c +++ b/src/core/rawlog.c @@ -27,12 +27,25 @@ #include "misc.h" #include "write-buffer.h" #include "settings.h" +#ifdef HAVE_CAPSICUM +#include "capsicum.h" +#endif #include "servers.h" static int rawlog_lines; static int signal_rawlog; +static int rawlog_open_wrapper(const char *path, int flags, int mode) +{ +#ifdef HAVE_CAPSICUM + if (capsicum_enabled()) + return capsicum_open(path, flags, mode); +#endif + + return open(path, flags, mode); +} + RAWLOG_REC *rawlog_create(void) { RAWLOG_REC *rec; @@ -126,7 +139,7 @@ void rawlog_open(RAWLOG_REC *rawlog, const char *fname) return; path = convert_home(fname); - rawlog->handle = open(path, O_WRONLY | O_APPEND | O_CREAT, + rawlog->handle = rawlog_open_wrapper(path, O_WRONLY | O_APPEND | O_CREAT, log_file_create_mode); g_free(path); @@ -158,7 +171,7 @@ void rawlog_save(RAWLOG_REC *rawlog, const char *fname) g_free(dir); path = convert_home(fname); - f = open(path, O_WRONLY | O_APPEND | O_CREAT, log_file_create_mode); + f = rawlog_open_wrapper(path, O_WRONLY | O_APPEND | O_CREAT, log_file_create_mode); g_free(path); if (f < 0) { |