security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

sandbox: unwrap path string
All checks were successful
Test / Create distribution (push) Successful in 24s
Details
Test / Fortify (push) Successful in 2m35s
Details
Test / Fpkg (push) Successful in 3m21s
Details
Test / Data race detector (push) Successful in 4m9s
Details
Test / Flake checks (push) Successful in 50s
Details

Browse Source 
Mount proc and dev takes no additional parameters.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-03-17 15:33:20 +09:00
parent 007b52d81f
commit 904208b87f
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 30 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
sandbox/sequential.go
View File

@ -41,47 +41,54 @@ func (f *Ops) Bind(source, target string, flags int) *Ops {
func init() { gob.Register(new(MountProc)) } func init() { gob.Register(new(MountProc)) }
// MountProc mounts a private proc instance on container Path. // MountProc mounts a private instance of proc.
type MountProc struct { type MountProc string
Path string
}
func (p *MountProc) apply(*InitParams) error { func (p MountProc) apply(*InitParams) error {
if !path.IsAbs(p.Path) { v := string(p)
if !path.IsAbs(v) {
return msg.WrapErr(syscall.EBADE, return msg.WrapErr(syscall.EBADE,
fmt.Sprintf("path %q is not absolute", p.Path)) fmt.Sprintf("path %q is not absolute", v))
} }
target := toSysroot(p.Path) target := toSysroot(v)
if err := os.MkdirAll(target, 0755); err != nil { if err := os.MkdirAll(target, 0755); err != nil {
return msg.WrapErr(err, err.Error()) return msg.WrapErr(err, err.Error())
} }
return wrapErrSuffix(syscall.Mount("proc", target, "proc", return wrapErrSuffix(syscall.Mount("proc", target, "proc",
syscall.MS_NOSUID|syscall.MS_NOEXEC|syscall.MS_NODEV, ""), syscall.MS_NOSUID|syscall.MS_NOEXEC|syscall.MS_NODEV, ""),
fmt.Sprintf("cannot mount proc on %q:", p.Path)) fmt.Sprintf("cannot mount proc on %q:", v))
}
func (p MountProc) Is(op Op) bool { vp, ok := op.(MountProc); return ok && p == vp }
func (p MountProc) String() string { return fmt.Sprintf("proc on %q", string(p)) }
func (f *Ops) Proc(dest string) *Ops {
*f = append(*f, MountProc(dest))
return f
} }
func init() { gob.Register(new(MountDev)) } func init() { gob.Register(new(MountDev)) }
// MountDev mounts dev on container Path. // MountDev mounts part of host dev.
type MountDev struct { type MountDev string
Path string
}
func (d *MountDev) apply(params *InitParams) error { func (d MountDev) apply(params *InitParams) error {
if !path.IsAbs(d.Path) { v := string(d)
if !path.IsAbs(v) {
return msg.WrapErr(syscall.EBADE, return msg.WrapErr(syscall.EBADE,
fmt.Sprintf("path %q is not absolute", d.Path)) fmt.Sprintf("path %q is not absolute", v))
} }
target := toSysroot(d.Path) target := toSysroot(v)
if err := mountTmpfs("devtmpfs", d.Path, 0, 0755); err != nil { if err := mountTmpfs("devtmpfs", v, 0, 0755); err != nil {
return err return err
} }
for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} { for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} {
if err := bindMount( if err := bindMount(
"/dev/"+name, path.Join(d.Path, name), "/dev/"+name, path.Join(v, name),
BindSource|BindDevices, BindSource|BindDevices,
); err != nil { ); err != nil {
return err return err
@ -126,7 +133,7 @@ func (d *MountDev) apply(params *InitParams) error {
uintptr(unsafe.Pointer(&buf[0])), uintptr(unsafe.Pointer(&buf[0])),
); errno == 0 { ); errno == 0 {
if err := bindMount( if err := bindMount(
"/proc/self/fd/1", path.Join(d.Path, "console"), "/proc/self/fd/1", path.Join(v, "console"),
BindDevices, BindDevices,
); err != nil { ); err != nil {
return err return err
@ -137,17 +144,10 @@ func (d *MountDev) apply(params *InitParams) error {
return nil return nil
} }
func (d *MountDev) Is(op Op) bool { vd, ok := op.(*MountDev); return ok && *d == *vd } func (d MountDev) Is(op Op) bool { vd, ok := op.(MountDev); return ok && d == vd }
func (d *MountDev) String() string { return fmt.Sprintf("dev on %q", d.Path) } func (d MountDev) String() string { return fmt.Sprintf("dev on %q", string(d)) }
func (f *Ops) Dev(dest string) *Ops { func (f *Ops) Dev(dest string) *Ops {
*f = append(*f, &MountDev{dest}) *f = append(*f, MountDev(dest))
return f
}
func (p *MountProc) Is(op Op) bool { vp, ok := op.(*MountProc); return ok && *p == *vp }
func (p *MountProc) String() string { return fmt.Sprintf("proc on %q", p.Path) }
func (f *Ops) Proc(dest string) *Ops {
*f = append(*f, &MountProc{dest})
return f return f
} }