Commit Graph

29 Commits

Author SHA1 Message Date
Simon McVittie
7e62e8dafe Allow building on old glibc without PR_SET_CHILD_SUBREAPER defined
Signed-off-by: Simon McVittie <smcv@collabora.com>
2022-04-05 14:48:23 +01:00
Simon McVittie
9d187f096d utils: Add warn()
Signed-off-by: Simon McVittie <smcv@collabora.com>
2021-10-10 13:07:28 +01:00
Simon McVittie
a6c90c516b Add SPDX-License-Identifier for files that already specify license
This is a step towards REUSE compliance. Third-party files that we do
not otherwise edit (git.mk, m4/attributes.m4) are excluded here.

Signed-off-by: Simon McVittie <smcv@collabora.com>
2021-08-31 12:32:40 +01:00
Colin Walters
136b3166bb Merge pull request #401 from smcv/clearenv
Add --clearenv option
2021-06-23 09:29:52 -04:00
Simon McVittie
8f72ceb2c4 Add --clearenv option
This allows environment variables to be set when running bwrap itself
(perhaps a custom LD_LIBRARY_PATH), but cleared for the command that
runs in the container, without having to enumerate all the variables.

Because PWD is set later, as a side-effect of changing directory, this
actually clears everything except PWD.

A portable program would check for clearenv() (and if not found, fall
back to using environ = NULL), but bubblewrap is Linux-specific, and
Linux C libraries (at least glibc and musl) do have clearenv().

Signed-off-by: Simon McVittie <smcv@collabora.com>
2021-06-22 17:57:35 +01:00
Ludovico de Nittis
04c0ca17ad Add support for bind-mount on case-insensitive filesystems
If we are using a case-insensitive filesystem the bind-mount operation
might fail when `/proc/self/mountinfo` is checked.

In a case-insensitive filesystem, if we ask to mount a certain
directory, e.g. '/CI_fs/foo', the kernel might add its entry in
`mountinfo` as '/CI_fs/FOO'. This happens because the kernel populates
`mountinfo` with whatever case combination first appeared in the dcache.

With this patch we open the requested path and look at its
`/proc/self/fd`, using readlink(), to get the path case combination that
the kernel is also expected to be using.

Signed-off-by: Ludovico de Nittis <ludovico.denittis@collabora.com>
2021-02-16 13:46:10 +01:00
Alexander Larsson
4a7ecc630f utils: Add fork_intermediate_child() helper
This just forks and exits in the parent, continuing in the child.
2019-11-22 11:17:42 +01:00
Alexander Larsson
d068ec2bfa utils: Add some utility function to pass pids over a socket
This uses SCM_CREDENTIALS as a way to translate pids between the
sender and the destination namespaces.
2019-11-22 11:17:42 +01:00
Alexander Larsson
1e90a18a08 Don't rely on mkdir returning EEXISTS (fixing NFS)
For NFS mounts if we call mkdir() on a read-only mount (such as when
we've created a read-only bind mount) the kernel will nor return EEXIST
even when the directory exists, instead returning EROFS.

So, we add (and use) an ensure_dir() helper that stats before calling
mkdir.

Closes: #258
Approved by: giuseppe
2018-03-16 22:07:13 +00:00
Colin Walters
821ee95e6d utils: Add __attribute__((printf)) to die()
Clang notices it's missing in the new PR testing.

Closes: #128
Approved by: alexlarsson
2016-12-12 15:04:03 +00:00
Alexander Larsson
c9c5dda3e1 utils: Add path_equal()
Closes: #118
Approved by: alexlarsson
2016-11-15 13:57:43 +00:00
Colin Walters
fdf82f9b14 Use #pragma once for headers
It's shorter and more reliable.  Also GCC/CLang specific, but that's
fine because that's all we support anyways.

Closes: #69

Closes: #70
Approved by: mrunalp
2016-05-19 02:41:33 +00:00
Alexander Larsson
d69ab9202b Ran uncruftify.sh
Closes: #67
Approved by: cgwalters
2016-05-13 12:21:08 +00:00
Mrunal Patel
4c943ddc5a Convert tabs to spaces
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Closes: #65
Approved by: cgwalters
2016-05-12 18:24:12 +00:00
Colin Walters
bf6e3564a3 utils: Rename strdup_printf -> xasprintf
I find this clearer since I know about `asprintf`, and the `x` prefix.

Closes: #55
Approved by: alexlarsson
2016-05-07 06:52:05 +00:00
Dan Walsh
35e664940c SELinux: Combine label_valid and label_support into one function
All calls to set an SELinux label should call this function

die_unless_label_valid (opt_exec_label);

It will make sure SELinux is enabled and will make sure the user passed in a
valid label.

Signed-off-by: Alexander Larsson <alexl@redhat.com>

Signed-off-by: Dan Walsh <dwalsh@redhat.com>

Closes: #53
Approved by: cgwalters
2016-05-06 16:31:40 +00:00
Colin Walters
a91f6a7469 utils: Add some __attribute__ annotations for format, noreturn
In particular `format` is important for validating strings.  Luckily
we don't have any new warnings.

`noreturn` is mostly just helps avoid other warnings from unreachable
code.

Closes: #51
Approved by: rhatdan
2016-05-06 13:40:40 +00:00
Dan Walsh
5601aae36c SELinux: Ensure we validate labels
Verify you are getting a valid SELinux label before proceeding.  Some
SELinux checks were broken.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>

Closes: #43
Approved by: cgwalters
2016-05-05 14:43:39 +00:00
Alexander Larsson
b3298904fc Ignore errors when writing to event_fd in a better way
GCC was failing this because write is marked warn_unused_result.
Assigning it to a attribute unused variable is apparently "better"
than casting it to void...

Also, we avoid taking this path at all if event_fd is -1.

Closes: #32
Approved by: alexlarsson
2016-04-08 10:45:42 +00:00
Dan Walsh
506fb1b162 Add SELinux Support
Signed-off-by: Dan Walsh <dwalsh@redhat.com>

Pull request: #25
Approved by: alexlarsson
2016-03-22 09:33:46 +00:00
Alexander Larsson
23b8fb6f1a Add has_path_prefix util 2016-03-07 10:21:06 +01:00
Alexander Larsson
46037fc88f Add seccomp support 2016-02-29 14:44:23 +01:00
Alexander Larsson
4d248d225e Break out load_file_data() helper 2016-02-29 13:58:24 +01:00
Alexander Larsson
c3dd820adf When creating file bind mount destinations, check if they already exist
If they already exist as a regular file then we don't need to create
it, which is good because doing so would break if the filesystem
is readonly. I.e. that returns EROFS instead of EEXISTS in that case.
2016-02-19 10:51:37 +01:00
Alexander Larsson
92712d8cd5 Rename to bubblewrap 2016-02-17 11:54:21 +01:00
Alexander Larsson
f5b006ff0c Support --make-file 2016-02-16 15:55:08 +01:00
Alexander Larsson
c68e0dfef6 Add some more util funcs and clean up utils.c 2016-02-16 10:51:18 +01:00
Alexander Larsson
dafe63b41e Move more helper functions to utils.c 2016-02-16 09:55:01 +01:00
Alexander Larsson
2f58265dce Break out utils to separate file 2016-02-16 09:36:33 +01:00