#endif
#include "pathconfig.h"
-#include "sys_clone.h"
#include "util.h"
-#include "lib/vserver.h"
-#include "lib/internal.h"
+#include <lib/vserver.h>
+#include <lib/internal.h>
+#include <lib_internal/sys_clone.h>
#include <sys/socket.h>
#include <dlfcn.h>
#include <pwd.h>
#include <grp.h>
+
+ // from selinux.h
+ // FIXME: add configure autodetection and include <selinux.h> directly
+int rpm_execcon(unsigned int verified,
+ const char *filename,
+ char *const argv[], char *const envp[]);
+
+
#define ENSC_WRAPPERS_PREFIX "rpm-fake.so: "
#define ENSC_WRAPPERS_VSERVER 1
#define ENSC_WRAPPERS_UNISTD 1
static bool is_initialized = false;
-DECLARE(execv);
+ //DECLARE(rpm_execcon);
+ //DECLARE(execv);
DECLARE(getpwnam);
DECLARE(getgrnam);
DECLARE(endpwent);
xid_t rc=VC_NOCTX;
if ((xid==VC_DYNAMIC_XID || !vc_is_dynamic_xid(xid)) &&
- (rc=vc_create_context(xid))==VC_NOCTX &&
+ (rc=vc_ctx_create(xid))==VC_NOCTX &&
errno!=EEXIST) {
perror(ENSC_WRAPPERS_PREFIX "vc_create_context()");
exit(255);
l = utilvserver_fmt_uint(buf+sizeof("rpm-fake.so #")-1, getppid());
Evc_set_vhi_name(rc, vcVHI_CONTEXT, buf, sizeof("rpm-fake.so #")+l-1);
- caps.ccaps = ~0ull;
+ caps.ccaps = 0ull;
caps.cmask = ~0ull;
- caps.bcaps = ~vc_get_securecaps();
+ caps.bcaps = ~vc_get_insecurebcaps();
caps.bmask = ~0ull;
Evc_set_ccaps(rc, &caps);
}
if (pid==0) {
- char const *args[15];
+ char const *args[20];
char const **ptr = args;
char const *env[] = { "HOME=/", "PATH=/bin:/usr/bin", 0 };
char const *xid_str;
+ char flag_str[ sizeof(flags)*3 + 2];
+ char caps_str[ sizeof(caps)*3 + 2];
setsid();
dup2(res_sock[1], 0);
close(res_sock[1]);
/* ... *socket[0] are marked as close-on-exec ...*/
+ flag_str[utilvserver_fmt_uint(flag_str, flags)] = '\0';
+ caps_str[utilvserver_fmt_uint(caps_str, caps)] = '\0';
+
*ptr++ = resolver;
+ *ptr++ = "-F"; *ptr++ = flag_str;
+ *ptr++ = "-C"; *ptr++ = caps_str;
if (root) { *ptr++ = "-r"; *ptr++ = root; }
if (uid) { *ptr++ = "-u"; *ptr++ = uid; }
if (gid) { *ptr++ = "-g"; *ptr++ = gid; }
static void
initSymbols()
{
- INIT(RTLD_NEXT, execv);
+ //INIT(RTLD_NEXT, rpm_execcon);
+ //INIT(RTLD_NEXT, execv);
INIT(RTLD_NEXT, getgrnam);
INIT(RTLD_NEXT, getpwnam);
INIT(RTLD_NEXT, endpwent);
static int
-execvWorker(char const *path, char * const argv[])
+execvWorker(char const *path, char * const argv[], char * const envp[])
{
- int res;
+ int res = -1;
if (vc_isSupported(vcFEATURE_MIGRATE))
- res = vc_migrate_context(ctx);
+ res = vc_ctx_migrate(ctx);
else
+#ifdef VC_ENABLE_API_COMPAT
res = vc_new_s_context(ctx,caps,flags);
-
+#else
+ WRITE_MSG(2, ENSC_WRAPPERS_PREFIX "can not change context: migrate kernel feature missing and 'compat' API disabled\n");
+#endif
+
if (res!=-1)
- res=execv_func(path, argv);
+ res=execve(path, argv, envp);
return res;
}
{
char const * path;
char * const * argv;
+ char * const * envp;
char const * mnts;
};
ptr = strtok(0, ":");
}
- return execvWorker(params->path, params->argv);
+ return execvWorker(params->path, params->argv, params->envp);
}
static int
-removeNamespaceMounts(char const *path, char * const argv[])
+removeNamespaceMounts(char const *path,
+ char * const argv[], char * const envp[])
{
- if (mnts==0) return execvWorker(path, argv);
+ if (mnts==0) return execvWorker(path, argv, envp);
{
int status;
params.path = path;
params.argv = argv;
+ params.envp = envp;
params.mnts = mnts;
// the rpmlib signal-handler is still active; use the default one to
int
-execv(char const *path, char * const argv[]) __THROW
+execv(char const *path, char * const argv[])
+{
+ extern char **environ;
+
+ return removeNamespaceMounts(path, argv, environ);
+}
+
+int
+rpm_execcon(unsigned int UNUSED verified,
+ const char *filename,
+ char *const argv[], char *const envp[])
{
- return removeNamespaceMounts(path, argv);
+ return removeNamespaceMounts(filename, argv, envp);
}