Overview
| Comment: | Disable seccomp support by default and cleanup |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | seccomp |
| Files: | files | file ages | folders |
| SHA1: |
9184a4f1b9c6e71f3c5fc4ec8bb3b8eb |
| User & Date: | rkeene on 2020-03-31 16:18:23 |
| Other Links: | branch diff | manifest | tags |
Context
|
2020-03-31
| ||
| 16:25 | Updated to not try to build seccomp dependencies unless seccomp is being used check-in: 0a04450d6f user: rkeene tags: seccomp | |
| 16:18 | Disable seccomp support by default and cleanup check-in: 9184a4f1b9 user: rkeene tags: seccomp | |
| 15:44 | Added seccomp support check-in: 854cb424a1 user: rkeene tags: seccomp | |
Changes
Modified Makefile from [c0971efb30] to [e9e57ad197].
| ︙ | ︙ | |||
20 21 22 23 24 25 26 | filed-mime-types.h: $(srcdir)/generate-mime-types $(srcdir)/mime.types '$(srcdir)/generate-mime-types' '$(MIMETYPES)' > filed-mime-types.h.new || \ '$(srcdir)/generate-mime-types' '$(srcdir)/mime.types' > filed-mime-types.h.new mv filed-mime-types.h.new filed-mime-types.h filed.seccomp.h: $(srcdir)/filed.seccomp $(srcdir)/generate-seccomp-filter | | | 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | filed-mime-types.h: $(srcdir)/generate-mime-types $(srcdir)/mime.types '$(srcdir)/generate-mime-types' '$(MIMETYPES)' > filed-mime-types.h.new || \ '$(srcdir)/generate-mime-types' '$(srcdir)/mime.types' > filed-mime-types.h.new mv filed-mime-types.h.new filed-mime-types.h filed.seccomp.h: $(srcdir)/filed.seccomp $(srcdir)/generate-seccomp-filter $(srcdir)/generate-seccomp-filter $(srcdir)/filed.seccomp x86_64 "" i386 "" > filed.seccomp.h.new mv filed.seccomp.h.new filed.seccomp.h install: filed $(srcdir)/filed.1 test -d "$(DESTDIR)$(mandir)/man1" || mkdir -p "$(DESTDIR)$(mandir)/man1" test -d "$(DESTDIR)$(bindir)" || mkdir -p "$(DESTDIR)$(bindir)" cp '$(srcdir)/filed.1' "$(DESTDIR)$(mandir)/man1/" cp filed "$(DESTDIR)$(bindir)/" |
| ︙ | ︙ |
Modified README from [dc3dfdd9b3] to [a70a50af88].
| ︙ | ︙ | |||
75 76 77 78 79 80 81 82 83 84 85 86 87 88 |
argument to the "-r" or "--root" option prepended to them.
5. Differing "index.html" handling (CFLAGS, -DFILED_DONT_REDIRECT_DIRECTORIES=1)
Normally "filed" redirects users who request a directory to the
index.html file in that directory so that no memory allocations are
required; This option lets the server generate the new path.
6. MIME Types (MIMETYPES)
For single-file convenience "filed" compiles the mapping of file
extensions (the string in the filename following its last dot ("."))
into the executable. This mapping comes from a file in the format of
type1 type1_extension1 type1_extension2...
type2 type2_extension1 type2_extension2...
...
| > > > > > | 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 |
argument to the "-r" or "--root" option prepended to them.
5. Differing "index.html" handling (CFLAGS, -DFILED_DONT_REDIRECT_DIRECTORIES=1)
Normally "filed" redirects users who request a directory to the
index.html file in that directory so that no memory allocations are
required; This option lets the server generate the new path.
6. Enable seccomp (CFLAGS, -DFILED_DO_SECCOMP=1)
Linux supports limiting the system calls that a process can make.
This is called seccomp (SECure COMPuting). Currently not all
platforms have been tested with this so it is disabled by default.
6. MIME Types (MIMETYPES)
For single-file convenience "filed" compiles the mapping of file
extensions (the string in the filename following its last dot ("."))
into the executable. This mapping comes from a file in the format of
type1 type1_extension1 type1_extension2...
type2 type2_extension1 type2_extension2...
...
|
| ︙ | ︙ |
Modified build/build-precompiled from [46b4f35d88] to [bda883498c].
| ︙ | ︙ | |||
40 41 42 43 44 45 46 |
case "${platform}" in
*-musl-*|*-musl)
make_extra=("${make_extra[@]}" FILED_EXTRA_LDFLAGS="-static")
;;
esac
| | > > > > | 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 |
case "${platform}" in
*-musl-*|*-musl)
make_extra=("${make_extra[@]}" FILED_EXTRA_LDFLAGS="-static")
;;
esac
make "${make_extra[@]}" > filed.log 2>&1 </dev/null || mv filed.log filed-failed.log
) &
done
done
# Wait for that to get done
wait
# Rename the files into place
mkdir -p compiled
for binary in workdir-buildPrecompiled-*/filed; do
platform="$(echo "${binary}" | sed 's@^.*-platform-@@;s@/.*$@@')"
mv "${binary}" "compiled/filed-${version}-${platform}"
done
for errorLog in workdir-buildPrecompiled-*/filed-failed.log; do
platform="$(echo "${errorLog}" | sed 's@^.*-platform-@@;s@/.*$@@')"
mv "${errorLog}" "compiled/filed-${version}-${platform}-error.log"
done
# Cleanup
rm -rf workdir-buildPrecompiled-*
exit 0
|
Modified filed.c from [61d8dcb4f5] to [94d290b0bc].
| ︙ | ︙ | |||
21 22 23 24 25 26 27 | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #include <sys/sendfile.h> #include <sys/socket.h> #include <sys/types.h> | < | 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #include <sys/sendfile.h> #include <sys/socket.h> #include <sys/types.h> #include <arpa/inet.h> #include <sys/mman.h> #include <sys/stat.h> #include <sys/wait.h> #include <pthread.h> #include <strings.h> #include <signal.h> |
| ︙ | ︙ | |||
603 604 605 606 607 608 609 |
pthread_create(&thread_id, NULL, filed_logging_thread, args);
filed_log_msg("START");
return(0);
}
| | | 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 |
pthread_create(&thread_id, NULL, filed_logging_thread, args);
filed_log_msg("START");
return(0);
}
#endif /* FILED_DONT_LOG */
#ifdef FILED_DONT_TIMEOUT
#define filed_sockettimeout_thread_init() 0
#define filed_sockettimeout_init() 0
#define filed_sockettimeout_accept(x) /**/
#define filed_sockettimeout_processing_start(x) /**/
#define filed_sockettimeout_processing_end(x) /**/
|
| ︙ | ︙ | |||
724 725 726 727 728 729 730 731 732 733 734 735 736 737 |
pthread_t thread_id;
long idx;
int count;
int valid;
int time_interval = 30;
int check_period = 90;
while (1) {
for (count = 0; count < (check_period / time_interval); count++) {
sleep_time.tv_sec = time_interval;
sleep_time.tv_nsec = 0;
nanosleep(&sleep_time, NULL);
pthread_mutex_lock(&filed_sockettimeout_mutex);
| > > | 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 |
pthread_t thread_id;
long idx;
int count;
int valid;
int time_interval = 30;
int check_period = 90;
filed_sockettimeout_time = time(NULL);
while (1) {
for (count = 0; count < (check_period / time_interval); count++) {
sleep_time.tv_sec = time_interval;
sleep_time.tv_nsec = 0;
nanosleep(&sleep_time, NULL);
pthread_mutex_lock(&filed_sockettimeout_mutex);
|
| ︙ | ︙ | |||
752 753 754 755 756 757 758 | continue; } expiration_time = filed_sockettimeout_sockstatus[idx].expiration_time; thread_id = filed_sockettimeout_sockstatus[idx].thread_id; | | | 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 |
continue;
}
expiration_time = filed_sockettimeout_sockstatus[idx].expiration_time;
thread_id = filed_sockettimeout_sockstatus[idx].thread_id;
if (expiration_time > filed_sockettimeout_time) {
continue;
}
filed_sockettimeout_close(idx, 1);
dup2(filed_sockettimeout_devnull_fd, idx);
|
| ︙ | ︙ | |||
805 806 807 808 809 810 811 |
filed_sockettimeout_devnull_fd = open("/dev/null", O_RDWR);
if (filed_sockettimeout_devnull_fd < 0) {
return(-1);
}
return(0);
}
| | > > > > | 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 |
filed_sockettimeout_devnull_fd = open("/dev/null", O_RDWR);
if (filed_sockettimeout_devnull_fd < 0) {
return(-1);
}
return(0);
}
#endif /* FILED_DONT_TIMEOUT */
#ifndef FILED_DO_SECCOMP
#define filed_init_seccomp() 0
#else
#include <linux/seccomp.h>
#include <linux/filter.h>
#include <linux/audit.h>
#include <sys/ptrace.h>
#include <sys/prctl.h>
#include <stddef.h>
static int filed_init_seccomp(void) {
struct sock_fprog filter;
struct sock_filter rules[] = {
#include "filed.seccomp.h"
};
|
| ︙ | ︙ | |||
836 837 838 839 840 841 842 843 844 845 846 847 848 849 |
prctl_ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filter);
if (prctl_ret != 0) {
return(-1);
}
return(0);
}
/* Format time per RFC2616 */
static char *filed_format_time(char *buffer, size_t buffer_len, const time_t timeinfo) {
struct tm timeinfo_tm, *timeinfo_tm_p;
timeinfo_tm_p = gmtime_r(&timeinfo, &timeinfo_tm);
if (timeinfo_tm_p == NULL) {
| > | 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 |
prctl_ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filter);
if (prctl_ret != 0) {
return(-1);
}
return(0);
}
#endif /* FILED_DO_SECCOMP */
/* Format time per RFC2616 */
static char *filed_format_time(char *buffer, size_t buffer_len, const time_t timeinfo) {
struct tm timeinfo_tm, *timeinfo_tm_p;
timeinfo_tm_p = gmtime_r(&timeinfo, &timeinfo_tm);
if (timeinfo_tm_p == NULL) {
|
| ︙ | ︙ | |||
1702 1703 1704 1705 1706 1707 1708 |
}
return;
}
/* Add a getopt option */
static void filed_getopt_long_setopt(struct option *opt, const char *name, int has_arg, int val) {
| | | 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 |
}
return;
}
/* Add a getopt option */
static void filed_getopt_long_setopt(struct option *opt, const char *name, int has_arg, int val) {
opt->name = (const char *) name;
opt->has_arg = has_arg;
opt->flag = NULL;
opt->val = val;
return;
}
|
| ︙ | ︙ | |||
1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 | int port = PORT, thread_count = THREAD_COUNT; int cache_size = CACHE_SIZE; int init_ret, chroot_ret, setuid_ret, lookup_ret, chdir_ret; int setuid_enabled = 0, daemon_enabled = 0; int ch; int fd; /* Process arguments */ filed_getopt_long_setopt(&options[0], "port", required_argument, 'p'); filed_getopt_long_setopt(&options[1], "threads", required_argument, 't'); filed_getopt_long_setopt(&options[2], "cache", required_argument, 'c'); filed_getopt_long_setopt(&options[3], "bind", required_argument, 'b'); filed_getopt_long_setopt(&options[4], "user", required_argument, 'u'); filed_getopt_long_setopt(&options[5], "root", required_argument, 'r'); | > > > | 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 | int port = PORT, thread_count = THREAD_COUNT; int cache_size = CACHE_SIZE; int init_ret, chroot_ret, setuid_ret, lookup_ret, chdir_ret; int setuid_enabled = 0, daemon_enabled = 0; int ch; int fd; /* Set default value */ thread_options.fake_newroot = NULL; /* Process arguments */ filed_getopt_long_setopt(&options[0], "port", required_argument, 'p'); filed_getopt_long_setopt(&options[1], "threads", required_argument, 't'); filed_getopt_long_setopt(&options[2], "cache", required_argument, 'c'); filed_getopt_long_setopt(&options[3], "bind", required_argument, 'b'); filed_getopt_long_setopt(&options[4], "user", required_argument, 'u'); filed_getopt_long_setopt(&options[5], "root", required_argument, 'r'); |
| ︙ | ︙ |