6 files changed, 65 insertions, 4 deletions
diff --git a/src/core/capsicum.c b/src/core/capsicum.c
index 5a59adcd..6667276c 100644
--- a/src/core/capsicum.c
+++ b/src/core/capsicum.c
@@ -20,6 +20,8 @@
 
 #include "module.h"
 #include "commands.h"
+#include "log.h"
+#include "misc.h"
 #include "network.h"
 #include "settings.h"
 #include "signals.h"
@@ -34,6 +36,9 @@
 #define	OPCODE_CONNECT		1
 #define	OPCODE_GETHOSTBYNAME	2
 
+static char *irclogs_path;
+static size_t irclogs_path_len;
+static int irclogs_fd;
 static int symbiontfds[2];
 
 gboolean capsicum_enabled(void)
@@ -127,6 +132,23 @@ int capsicum_net_gethostbyname(const char *addr, IPADDR *ip4, IPADDR *ip6)
 	return ret;
 }
 
+int capsicum_open(const char *path, int flags, int mode)
+{
+	int fd;
+
+	/* +1 is for slash separating irclogs_path and the rest. */
+	if (strlen(path) > irclogs_path_len + 1 && strncmp(path, irclogs_path, irclogs_path_len) == 0) {
+		fd = openat(irclogs_fd, path + irclogs_path_len + 1, flags, mode);
+	} else {
+		fd = open(path, flags, mode);
+	}
+
+	if (fd < 0 && (errno == ENOTCAPABLE || errno == ECAPMODE))
+		g_warning("File system access restricted to %s due to capability mode", irclogs_path);
+
+	return (fd);
+}
+
 nvlist_t *symbiont_connect(const nvlist_t *request)
 {
 	nvlist_t *response;
@@ -261,6 +283,16 @@ static void cmd_capsicum_enter(void)
 		return;
 	}
 
+	irclogs_path = convert_home(settings_get_str("capsicum_irclogs_path"));
+	g_mkdir_with_parents(irclogs_path, log_dir_create_mode);
+	irclogs_path_len = strlen(irclogs_path);
+	irclogs_fd = open(irclogs_path, O_DIRECTORY | O_CLOEXEC);
+	if (irclogs_fd < 0) {
+		g_warning("Unable to open %s: %s", irclogs_path, strerror(errno));
+		signal_emit("capability mode failed", 1, strerror(errno));
+		return;
+	}
+
 	error = start_symbiont();
 	if (error != 0) {
 		signal_emit("capability mode failed", 1, strerror(errno));
@@ -299,6 +331,7 @@ void sig_init_finished(void)
 void capsicum_init(void)
 {
 	settings_add_bool("misc", "capsicum", FALSE);
+	settings_add_str("misc", "capsicum_irclogs_path", "~/irclogs");
 
 	signal_add("irssi init finished", (SIGNAL_FUNC) sig_init_finished);
 
diff --git a/src/core/capsicum.h b/src/core/capsicum.h
index 2733c1ea..ca35fd05 100644
--- a/src/core/capsicum.h
+++ b/src/core/capsicum.h
@@ -4,6 +4,7 @@
 gboolean capsicum_enabled(void);
 int capsicum_net_connect_ip(IPADDR *ip, int port, IPADDR *my_ip);
 int capsicum_net_gethostbyname(const char *addr, IPADDR *ip4, IPADDR *ip6);
+int capsicum_open(const char *path, int flags, int mode);
 
 void capsicum_init(void);
 void capsicum_deinit(void);
diff --git a/src/core/log.c b/src/core/log.c
index cee1dab5..00686bee 100644
--- a/src/core/log.c
+++ b/src/core/log.c
@@ -26,6 +26,9 @@
 #include "servers.h"
 #include "log.h"
 #include "write-buffer.h"
+#ifdef HAVE_CAPSICUM
+#include "capsicum.h"
+#endif
 
 #include "lib-config/iconfig.h"
 #include "settings.h"
@@ -73,6 +76,16 @@ static void log_write_timestamp(int handle, const char *format,
 	if (text != NULL) write_buffer(handle, text, strlen(text));
 }
 
+static int log_open_wrapper(const char *path, int flags, int mode)
+{
+#ifdef HAVE_CAPSICUM
+	if (capsicum_enabled())
+		return capsicum_open(path, flags, mode);
+#endif
+
+	return open(path, flags, mode);
+}
+
 static char *log_filename(LOG_REC *log)
 {
 	char *str, fname[1024];
@@ -119,7 +132,7 @@ int log_start_logging(LOG_REC *log)
 	}
 
 	log->handle = log->real_fname == NULL ? -1 :
-		open(log->real_fname, O_WRONLY | O_APPEND | O_CREAT,
+		log_open_wrapper(log->real_fname, O_WRONLY | O_APPEND | O_CREAT,
 		     log_file_create_mode);
 	if (log->handle == -1) {
 		signal_emit("log create failed", 1, log);
diff --git a/src/core/log.h b/src/core/log.h
index 5a07859b..52660bb9 100644
--- a/src/core/log.h
+++ b/src/core/log.h
@@ -38,6 +38,8 @@ extern GSList *logs;
 extern int log_file_create_mode;
 extern int log_dir_create_mode;
 
+extern int log_dir_create_mode;
+
 /* Create log record - you still need to call log_update() to actually add it
    into log list */
 LOG_REC *log_create_rec(const char *fname, int level);
diff --git a/src/core/network.c b/src/core/network.c
index 01e56eb5..4494dbc6 100644
--- a/src/core/network.c
+++ b/src/core/network.c
@@ -198,7 +198,6 @@ int net_connect_ip_handle(const IPADDR *ip, int port, const IPADDR *my_ip)
 	return handle;
 }
 
-
 /* Connect to socket with ip address */
 GIOChannel *net_connect_ip(IPADDR *ip, int port, IPADDR *my_ip)
 {
diff --git a/src/core/rawlog.c b/src/core/rawlog.c
index 2ec155fa..5df02981 100644
--- a/src/core/rawlog.c
+++ b/src/core/rawlog.c
@@ -27,12 +27,25 @@
 #include "misc.h"
 #include "write-buffer.h"
 #include "settings.h"
+#ifdef HAVE_CAPSICUM
+#include "capsicum.h"
+#endif
 
 #include "servers.h"
 
 static int rawlog_lines;
 static int signal_rawlog;
 
+static int rawlog_open_wrapper(const char *path, int flags, int mode)
+{
+#ifdef HAVE_CAPSICUM
+	if (capsicum_enabled())
+		return capsicum_open(path, flags, mode);
+#endif
+
+	return open(path, flags, mode);
+}
+
 RAWLOG_REC *rawlog_create(void)
 {
 	RAWLOG_REC *rec;
@@ -126,7 +139,7 @@ void rawlog_open(RAWLOG_REC *rawlog, const char *fname)
 		return;
 
 	path = convert_home(fname);
-	rawlog->handle = open(path, O_WRONLY | O_APPEND | O_CREAT,
+	rawlog->handle = rawlog_open_wrapper(path, O_WRONLY | O_APPEND | O_CREAT,
 			      log_file_create_mode);
 	g_free(path);
 
@@ -158,7 +171,7 @@ void rawlog_save(RAWLOG_REC *rawlog, const char *fname)
         g_free(dir);
 
 	path = convert_home(fname);
-	f = open(path, O_WRONLY | O_APPEND | O_CREAT, log_file_create_mode);
+	f = rawlog_open_wrapper(path, O_WRONLY | O_APPEND | O_CREAT, log_file_create_mode);
 	g_free(path);
 
 	if (f < 0) {