mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
fix permission check for files
This commit is contained in:
parent
80f9a1a2d4
commit
ba976039cf
@ -9,17 +9,17 @@ import (
|
||||
)
|
||||
|
||||
// basename return path with last "/"
|
||||
func basename(path *string) string {
|
||||
if p := strings.LastIndex(*path, "/"); p >= 0 {
|
||||
return (*path)[:p+1]
|
||||
func basename(path string) string {
|
||||
if p := strings.LastIndex(path, "/"); p >= 0 {
|
||||
return path[:p+1]
|
||||
}
|
||||
return *path
|
||||
return path
|
||||
}
|
||||
|
||||
// dirname return path without last "/"
|
||||
func dirname(path *string) string {
|
||||
if p := strings.LastIndex(*path, "/"); p >= 0 {
|
||||
return (*path)[:p]
|
||||
func dirname(path string) string {
|
||||
if p := strings.LastIndex(path, "/"); p >= 0 {
|
||||
return path[:p]
|
||||
}
|
||||
return ""
|
||||
}
|
||||
@ -50,9 +50,9 @@ func absPath(pid int, p string) string {
|
||||
func realPath(p string) string {
|
||||
f, err := filepath.EvalSymlinks(p)
|
||||
if err != nil {
|
||||
return f
|
||||
return ""
|
||||
}
|
||||
return ""
|
||||
return f
|
||||
}
|
||||
|
||||
// fileSet stores the file permissions
|
||||
@ -90,7 +90,7 @@ func (s *fileSet) IsInSetSmart(name string) bool {
|
||||
if s.Set[name+"/"] {
|
||||
return true
|
||||
}
|
||||
name = dirname(&name)
|
||||
name = dirname(name)
|
||||
}
|
||||
if level == 1 && s.Set["/*"] {
|
||||
return true
|
||||
@ -113,20 +113,20 @@ func newFileSets() fileSets {
|
||||
return fileSets{newFileSet(), newFileSet(), newFileSet(), newFileSet()}
|
||||
}
|
||||
|
||||
func (s *fileSets) isWritableFile(name *string) bool {
|
||||
return s.Writable.IsInSetSmart(*name) || s.Writable.IsInSetSmart(realPath(*name))
|
||||
func (s *fileSets) isWritableFile(name string) bool {
|
||||
return s.Writable.IsInSetSmart(name) || s.Writable.IsInSetSmart(realPath(name))
|
||||
}
|
||||
|
||||
func (s *fileSets) isReadableFile(name *string) bool {
|
||||
return s.isWritableFile(name) || s.Readable.IsInSetSmart(*name) || s.Readable.IsInSetSmart(realPath(*name))
|
||||
func (s *fileSets) isReadableFile(name string) bool {
|
||||
return s.isWritableFile(name) || s.Readable.IsInSetSmart(name) || s.Readable.IsInSetSmart(realPath(name))
|
||||
}
|
||||
|
||||
func (s *fileSets) isStatableFile(name *string) bool {
|
||||
return s.isReadableFile(name) || s.Statable.IsInSetSmart(*name) || s.Statable.IsInSetSmart(realPath(*name))
|
||||
func (s *fileSets) isStatableFile(name string) bool {
|
||||
return s.isReadableFile(name) || s.Statable.IsInSetSmart(name) || s.Statable.IsInSetSmart(realPath(name))
|
||||
}
|
||||
|
||||
func (s *fileSets) isSoftBanFile(name *string) bool {
|
||||
return s.SoftBan.IsInSetSmart(*name) || s.SoftBan.IsInSetSmart(realPath(*name))
|
||||
func (s *fileSets) isSoftBanFile(name string) bool {
|
||||
return s.SoftBan.IsInSetSmart(name) || s.SoftBan.IsInSetSmart(realPath(name))
|
||||
}
|
||||
|
||||
func (s *fileSets) addFilePermission(name string, mode filePerm) {
|
||||
@ -137,7 +137,7 @@ func (s *fileSets) addFilePermission(name string, mode filePerm) {
|
||||
} else if mode == filePermStat {
|
||||
s.Statable.Add(name)
|
||||
}
|
||||
for name = dirname(&name); name != ""; name = dirname(&name) {
|
||||
for name = dirname(name); name != ""; name = dirname(name) {
|
||||
s.Statable.Add(name)
|
||||
}
|
||||
}
|
||||
|
||||
@ -43,9 +43,10 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
|
||||
}
|
||||
|
||||
onDgsFileDetect := func(ctx *tracer.Context, name string) tracer.TraceAction {
|
||||
if fs.isSoftBanFile(&name) {
|
||||
if fs.isSoftBanFile(name) {
|
||||
return softBanSyscall(ctx)
|
||||
}
|
||||
print("Dangerous fileopen: (killed)", name)
|
||||
return tracer.TraceKill
|
||||
}
|
||||
|
||||
@ -58,11 +59,11 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
|
||||
|
||||
print("open: ", fn, getFileMode(flags))
|
||||
if isReadOnly {
|
||||
if realPath(fn) != "" && !fs.isReadableFile(&fn) {
|
||||
if realPath(fn) != "" && !fs.isReadableFile(fn) {
|
||||
return onDgsFileDetect(ctx, fn)
|
||||
}
|
||||
} else {
|
||||
if realPath(fn) != "" && !fs.isWritableFile(&fn) {
|
||||
if realPath(fn) != "" && !fs.isWritableFile(fn) {
|
||||
return onDgsFileDetect(ctx, fn)
|
||||
}
|
||||
}
|
||||
@ -72,7 +73,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
|
||||
checkRead := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
|
||||
fn := ctx.GetString(uintptr(addr))
|
||||
print("check read: ", fn)
|
||||
if !fs.isReadableFile(&fn) {
|
||||
if !fs.isReadableFile(fn) {
|
||||
return onDgsFileDetect(ctx, fn)
|
||||
}
|
||||
return tracer.TraceAllow
|
||||
@ -81,7 +82,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
|
||||
checkWrite := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
|
||||
fn := ctx.GetString(uintptr(addr))
|
||||
print("check write: ", fn)
|
||||
if !fs.isWritableFile(&fn) {
|
||||
if !fs.isWritableFile(fn) {
|
||||
return onDgsFileDetect(ctx, fn)
|
||||
}
|
||||
return tracer.TraceAllow
|
||||
@ -90,7 +91,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
|
||||
checkStat := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
|
||||
fn := ctx.GetString(uintptr(addr))
|
||||
print("check stat: ", fn)
|
||||
if !fs.isStatableFile(&fn) {
|
||||
if !fs.isStatableFile(fn) {
|
||||
return onDgsFileDetect(ctx, fn)
|
||||
}
|
||||
return tracer.TraceAllow
|
||||
|
||||
@ -85,8 +85,10 @@ func main() {
|
||||
if !ok {
|
||||
c = tracer.TraceCodeFatal
|
||||
}
|
||||
|
||||
fmt.Fprintf(f, "%d %d %d %d\n", int(c), rt.UserTime, rt.UserMem, rt.ExitCode)
|
||||
// Handle fatal error from trace
|
||||
if rt != nil {
|
||||
fmt.Fprintf(f, "%d %d %d %d\n", int(c), rt.UserTime, rt.UserMem, rt.ExitCode)
|
||||
}
|
||||
if c == tracer.TraceCodeFatal {
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
@ -111,10 +111,10 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
|
||||
|
||||
// check tle / mle
|
||||
if rt.UserTime > r.TimeLimit*1e3 {
|
||||
return nil, TraceCodeTLE
|
||||
return &rt, TraceCodeTLE
|
||||
}
|
||||
if rt.UserMem > r.MemoryLimit<<10 {
|
||||
return nil, TraceCodeMLE
|
||||
return &rt, TraceCodeMLE
|
||||
}
|
||||
|
||||
// check process status
|
||||
@ -127,7 +127,7 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
|
||||
rt.ExitCode = wstatus.ExitStatus()
|
||||
return &rt, nil
|
||||
}
|
||||
return nil, TraceCodeFatal
|
||||
return &rt, TraceCodeFatal
|
||||
}
|
||||
continue
|
||||
|
||||
@ -137,13 +137,13 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
|
||||
if pid == rootPid {
|
||||
switch sig {
|
||||
case unix.SIGXCPU:
|
||||
return nil, TraceCodeTLE
|
||||
return &rt, TraceCodeTLE
|
||||
case unix.SIGXFSZ:
|
||||
return nil, TraceCodeOLE
|
||||
return &rt, TraceCodeOLE
|
||||
case unix.SIGSYS:
|
||||
return nil, TraceCodeBan
|
||||
return &rt, TraceCodeBan
|
||||
default:
|
||||
return nil, TraceCodeRE
|
||||
return &rt, TraceCodeRE
|
||||
}
|
||||
} else {
|
||||
delete(pids, pid)
|
||||
@ -158,7 +158,7 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
|
||||
// give the customized handle for syscall
|
||||
err := r.handleTrap(pid)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
return &rt, err
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user