Overview
| Comment: | Disable seccomp support by default and cleanup |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | seccomp |
| Files: | files | file ages | folders |
| SHA1: |
9184a4f1b9c6e71f3c5fc4ec8bb3b8eb |
| User & Date: | rkeene on 2020-03-31 16:18:23 |
| Other Links: | branch diff | manifest | tags |
Context
|
2020-03-31
| ||
| 16:25 | Updated to not try to build seccomp dependencies unless seccomp is being used check-in: 0a04450d6f user: rkeene tags: seccomp | |
| 16:18 | Disable seccomp support by default and cleanup check-in: 9184a4f1b9 user: rkeene tags: seccomp | |
| 15:44 | Added seccomp support check-in: 854cb424a1 user: rkeene tags: seccomp | |
Changes
Modified Makefile from [c0971efb30] to [e9e57ad197].
| ︙ | |||
20 21 22 23 24 25 26 | 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | - + | filed-mime-types.h: $(srcdir)/generate-mime-types $(srcdir)/mime.types '$(srcdir)/generate-mime-types' '$(MIMETYPES)' > filed-mime-types.h.new || \ '$(srcdir)/generate-mime-types' '$(srcdir)/mime.types' > filed-mime-types.h.new mv filed-mime-types.h.new filed-mime-types.h filed.seccomp.h: $(srcdir)/filed.seccomp $(srcdir)/generate-seccomp-filter |
| ︙ |
Modified README from [dc3dfdd9b3] to [a70a50af88].
| ︙ | |||
75 76 77 78 79 80 81 82 83 84 85 86 87 88 | 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 | + + + + + |
argument to the "-r" or "--root" option prepended to them.
5. Differing "index.html" handling (CFLAGS, -DFILED_DONT_REDIRECT_DIRECTORIES=1)
Normally "filed" redirects users who request a directory to the
index.html file in that directory so that no memory allocations are
required; This option lets the server generate the new path.
6. Enable seccomp (CFLAGS, -DFILED_DO_SECCOMP=1)
Linux supports limiting the system calls that a process can make.
This is called seccomp (SECure COMPuting). Currently not all
platforms have been tested with this so it is disabled by default.
6. MIME Types (MIMETYPES)
For single-file convenience "filed" compiles the mapping of file
extensions (the string in the filename following its last dot ("."))
into the executable. This mapping comes from a file in the format of
type1 type1_extension1 type1_extension2...
type2 type2_extension1 type2_extension2...
...
|
| ︙ |
Modified build/build-precompiled from [46b4f35d88] to [bda883498c].
| ︙ | |||
40 41 42 43 44 45 46 | 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 | - + + + + + |
case "${platform}" in
*-musl-*|*-musl)
make_extra=("${make_extra[@]}" FILED_EXTRA_LDFLAGS="-static")
;;
esac
|
Modified filed.c from [61d8dcb4f5] to [94d290b0bc].
| ︙ | |||
21 22 23 24 25 26 27 | 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | - | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #include <sys/sendfile.h> #include <sys/socket.h> #include <sys/types.h> |
| ︙ | |||
603 604 605 606 607 608 609 | 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 | - + |
pthread_create(&thread_id, NULL, filed_logging_thread, args);
filed_log_msg("START");
return(0);
}
|
| ︙ | |||
724 725 726 727 728 729 730 731 732 733 734 735 736 737 | 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 | + + |
pthread_t thread_id;
long idx;
int count;
int valid;
int time_interval = 30;
int check_period = 90;
filed_sockettimeout_time = time(NULL);
while (1) {
for (count = 0; count < (check_period / time_interval); count++) {
sleep_time.tv_sec = time_interval;
sleep_time.tv_nsec = 0;
nanosleep(&sleep_time, NULL);
pthread_mutex_lock(&filed_sockettimeout_mutex);
|
| ︙ | |||
752 753 754 755 756 757 758 | 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 | - + | continue; } expiration_time = filed_sockettimeout_sockstatus[idx].expiration_time; thread_id = filed_sockettimeout_sockstatus[idx].thread_id; |
| ︙ | |||
805 806 807 808 809 810 811 | 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 | - + + + + + |
filed_sockettimeout_devnull_fd = open("/dev/null", O_RDWR);
if (filed_sockettimeout_devnull_fd < 0) {
return(-1);
}
return(0);
}
|
| ︙ | |||
836 837 838 839 840 841 842 843 844 845 846 847 848 849 | 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 | + |
prctl_ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filter);
if (prctl_ret != 0) {
return(-1);
}
return(0);
}
#endif /* FILED_DO_SECCOMP */
/* Format time per RFC2616 */
static char *filed_format_time(char *buffer, size_t buffer_len, const time_t timeinfo) {
struct tm timeinfo_tm, *timeinfo_tm_p;
timeinfo_tm_p = gmtime_r(&timeinfo, &timeinfo_tm);
if (timeinfo_tm_p == NULL) {
|
| ︙ | |||
1702 1703 1704 1705 1706 1707 1708 | 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 | - + |
}
return;
}
/* Add a getopt option */
static void filed_getopt_long_setopt(struct option *opt, const char *name, int has_arg, int val) {
|
| ︙ | |||
1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 | 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 | + + + | int port = PORT, thread_count = THREAD_COUNT; int cache_size = CACHE_SIZE; int init_ret, chroot_ret, setuid_ret, lookup_ret, chdir_ret; int setuid_enabled = 0, daemon_enabled = 0; int ch; int fd; /* Set default value */ thread_options.fake_newroot = NULL; /* Process arguments */ filed_getopt_long_setopt(&options[0], "port", required_argument, 'p'); filed_getopt_long_setopt(&options[1], "threads", required_argument, 't'); filed_getopt_long_setopt(&options[2], "cache", required_argument, 'c'); filed_getopt_long_setopt(&options[3], "bind", required_argument, 'b'); filed_getopt_long_setopt(&options[4], "user", required_argument, 'u'); filed_getopt_long_setopt(&options[5], "root", required_argument, 'r'); |
| ︙ |