- Pre-open directory fds for the cwd and root dir. Use those to open all paths specified on the command line. This weakens the sandbox slightly, but avoids forking.
- For unix sockets, just try all of the socket types in turn rather than using getaddrinfo(), which can't easily be used in capability mode.
- Limit stdio descriptors.
Details
Details
- Reviewers
- None
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Skipped - Unit
Tests Skipped - Build Status
Buildable 73885 Build 70768: arc lint + arc unit
Event Timeline
Comment Actions
If you could wait a little before making this change, I'd appreciate it. I'm currently working on a similar mechanism built into fileargs when the number of file descriptors is below the cache size.
It should then be applicable to all programs, such as head, tail, etc.
Comment Actions
This is just a proposal, I am not planning on committing it yet.
I'm currently working on a similar mechanism built into fileargs when the number of file descriptors is below the cache size.
It should then be applicable to all programs, such as head, tail, etc.
Won't you still need cap_net for unix domain sockets?
I really think cap_fileargs is the wrong approach for unix filter programs. Pre-opening files gives subtly different semantics, e.g., if a path is a FIFO, or output from the command is redirected to an input file. I guess most of the performance overhead can be mitigated by avoiding fork() for some threshold number of files, but what's the right threshold?