fix permission check for files

This commit is contained in:
criyle 2019-04-15 18:49:25 -04:00
parent 80f9a1a2d4
commit ba976039cf
4 changed files with 38 additions and 35 deletions

View File

@ -9,17 +9,17 @@ import (
)
// basename return path with last "/"
func basename(path *string) string {
if p := strings.LastIndex(*path, "/"); p >= 0 {
return (*path)[:p+1]
func basename(path string) string {
if p := strings.LastIndex(path, "/"); p >= 0 {
return path[:p+1]
}
return *path
return path
}
// dirname return path without last "/"
func dirname(path *string) string {
if p := strings.LastIndex(*path, "/"); p >= 0 {
return (*path)[:p]
func dirname(path string) string {
if p := strings.LastIndex(path, "/"); p >= 0 {
return path[:p]
}
return ""
}
@ -50,9 +50,9 @@ func absPath(pid int, p string) string {
func realPath(p string) string {
f, err := filepath.EvalSymlinks(p)
if err != nil {
return f
return ""
}
return ""
return f
}
// fileSet stores the file permissions
@ -90,7 +90,7 @@ func (s *fileSet) IsInSetSmart(name string) bool {
if s.Set[name+"/"] {
return true
}
name = dirname(&name)
name = dirname(name)
}
if level == 1 && s.Set["/*"] {
return true
@ -113,20 +113,20 @@ func newFileSets() fileSets {
return fileSets{newFileSet(), newFileSet(), newFileSet(), newFileSet()}
}
func (s *fileSets) isWritableFile(name *string) bool {
return s.Writable.IsInSetSmart(*name) || s.Writable.IsInSetSmart(realPath(*name))
func (s *fileSets) isWritableFile(name string) bool {
return s.Writable.IsInSetSmart(name) || s.Writable.IsInSetSmart(realPath(name))
}
func (s *fileSets) isReadableFile(name *string) bool {
return s.isWritableFile(name) || s.Readable.IsInSetSmart(*name) || s.Readable.IsInSetSmart(realPath(*name))
func (s *fileSets) isReadableFile(name string) bool {
return s.isWritableFile(name) || s.Readable.IsInSetSmart(name) || s.Readable.IsInSetSmart(realPath(name))
}
func (s *fileSets) isStatableFile(name *string) bool {
return s.isReadableFile(name) || s.Statable.IsInSetSmart(*name) || s.Statable.IsInSetSmart(realPath(*name))
func (s *fileSets) isStatableFile(name string) bool {
return s.isReadableFile(name) || s.Statable.IsInSetSmart(name) || s.Statable.IsInSetSmart(realPath(name))
}
func (s *fileSets) isSoftBanFile(name *string) bool {
return s.SoftBan.IsInSetSmart(*name) || s.SoftBan.IsInSetSmart(realPath(*name))
func (s *fileSets) isSoftBanFile(name string) bool {
return s.SoftBan.IsInSetSmart(name) || s.SoftBan.IsInSetSmart(realPath(name))
}
func (s *fileSets) addFilePermission(name string, mode filePerm) {
@ -137,7 +137,7 @@ func (s *fileSets) addFilePermission(name string, mode filePerm) {
} else if mode == filePermStat {
s.Statable.Add(name)
}
for name = dirname(&name); name != ""; name = dirname(&name) {
for name = dirname(name); name != ""; name = dirname(name) {
s.Statable.Add(name)
}
}

View File

@ -43,9 +43,10 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
}
onDgsFileDetect := func(ctx *tracer.Context, name string) tracer.TraceAction {
if fs.isSoftBanFile(&name) {
if fs.isSoftBanFile(name) {
return softBanSyscall(ctx)
}
print("Dangerous fileopen: (killed)", name)
return tracer.TraceKill
}
@ -58,11 +59,11 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
print("open: ", fn, getFileMode(flags))
if isReadOnly {
if realPath(fn) != "" && !fs.isReadableFile(&fn) {
if realPath(fn) != "" && !fs.isReadableFile(fn) {
return onDgsFileDetect(ctx, fn)
}
} else {
if realPath(fn) != "" && !fs.isWritableFile(&fn) {
if realPath(fn) != "" && !fs.isWritableFile(fn) {
return onDgsFileDetect(ctx, fn)
}
}
@ -72,7 +73,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
checkRead := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
fn := ctx.GetString(uintptr(addr))
print("check read: ", fn)
if !fs.isReadableFile(&fn) {
if !fs.isReadableFile(fn) {
return onDgsFileDetect(ctx, fn)
}
return tracer.TraceAllow
@ -81,7 +82,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
checkWrite := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
fn := ctx.GetString(uintptr(addr))
print("check write: ", fn)
if !fs.isWritableFile(&fn) {
if !fs.isWritableFile(fn) {
return onDgsFileDetect(ctx, fn)
}
return tracer.TraceAllow
@ -90,7 +91,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
checkStat := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
fn := ctx.GetString(uintptr(addr))
print("check stat: ", fn)
if !fs.isStatableFile(&fn) {
if !fs.isStatableFile(fn) {
return onDgsFileDetect(ctx, fn)
}
return tracer.TraceAllow

View File

@ -85,8 +85,10 @@ func main() {
if !ok {
c = tracer.TraceCodeFatal
}
fmt.Fprintf(f, "%d %d %d %d\n", int(c), rt.UserTime, rt.UserMem, rt.ExitCode)
// Handle fatal error from trace
if rt != nil {
fmt.Fprintf(f, "%d %d %d %d\n", int(c), rt.UserTime, rt.UserMem, rt.ExitCode)
}
if c == tracer.TraceCodeFatal {
os.Exit(1)
}

View File

@ -111,10 +111,10 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
// check tle / mle
if rt.UserTime > r.TimeLimit*1e3 {
return nil, TraceCodeTLE
return &rt, TraceCodeTLE
}
if rt.UserMem > r.MemoryLimit<<10 {
return nil, TraceCodeMLE
return &rt, TraceCodeMLE
}
// check process status
@ -127,7 +127,7 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
rt.ExitCode = wstatus.ExitStatus()
return &rt, nil
}
return nil, TraceCodeFatal
return &rt, TraceCodeFatal
}
continue
@ -137,13 +137,13 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
if pid == rootPid {
switch sig {
case unix.SIGXCPU:
return nil, TraceCodeTLE
return &rt, TraceCodeTLE
case unix.SIGXFSZ:
return nil, TraceCodeOLE
return &rt, TraceCodeOLE
case unix.SIGSYS:
return nil, TraceCodeBan
return &rt, TraceCodeBan
default:
return nil, TraceCodeRE
return &rt, TraceCodeRE
}
} else {
delete(pids, pid)
@ -158,7 +158,7 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
// give the customized handle for syscall
err := r.handleTrap(pid)
if err != nil {
return nil, err
return &rt, err
}
}