fix permission check for files

This commit is contained in:
criyle 2019-04-15 18:49:25 -04:00
parent 80f9a1a2d4
commit ba976039cf
4 changed files with 38 additions and 35 deletions

View File

@ -9,17 +9,17 @@ import (
) )
// basename return path with last "/" // basename return path with last "/"
func basename(path *string) string { func basename(path string) string {
if p := strings.LastIndex(*path, "/"); p >= 0 { if p := strings.LastIndex(path, "/"); p >= 0 {
return (*path)[:p+1] return path[:p+1]
} }
return *path return path
} }
// dirname return path without last "/" // dirname return path without last "/"
func dirname(path *string) string { func dirname(path string) string {
if p := strings.LastIndex(*path, "/"); p >= 0 { if p := strings.LastIndex(path, "/"); p >= 0 {
return (*path)[:p] return path[:p]
} }
return "" return ""
} }
@ -50,9 +50,9 @@ func absPath(pid int, p string) string {
func realPath(p string) string { func realPath(p string) string {
f, err := filepath.EvalSymlinks(p) f, err := filepath.EvalSymlinks(p)
if err != nil { if err != nil {
return f return ""
} }
return "" return f
} }
// fileSet stores the file permissions // fileSet stores the file permissions
@ -90,7 +90,7 @@ func (s *fileSet) IsInSetSmart(name string) bool {
if s.Set[name+"/"] { if s.Set[name+"/"] {
return true return true
} }
name = dirname(&name) name = dirname(name)
} }
if level == 1 && s.Set["/*"] { if level == 1 && s.Set["/*"] {
return true return true
@ -113,20 +113,20 @@ func newFileSets() fileSets {
return fileSets{newFileSet(), newFileSet(), newFileSet(), newFileSet()} return fileSets{newFileSet(), newFileSet(), newFileSet(), newFileSet()}
} }
func (s *fileSets) isWritableFile(name *string) bool { func (s *fileSets) isWritableFile(name string) bool {
return s.Writable.IsInSetSmart(*name) || s.Writable.IsInSetSmart(realPath(*name)) return s.Writable.IsInSetSmart(name) || s.Writable.IsInSetSmart(realPath(name))
} }
func (s *fileSets) isReadableFile(name *string) bool { func (s *fileSets) isReadableFile(name string) bool {
return s.isWritableFile(name) || s.Readable.IsInSetSmart(*name) || s.Readable.IsInSetSmart(realPath(*name)) return s.isWritableFile(name) || s.Readable.IsInSetSmart(name) || s.Readable.IsInSetSmart(realPath(name))
} }
func (s *fileSets) isStatableFile(name *string) bool { func (s *fileSets) isStatableFile(name string) bool {
return s.isReadableFile(name) || s.Statable.IsInSetSmart(*name) || s.Statable.IsInSetSmart(realPath(*name)) return s.isReadableFile(name) || s.Statable.IsInSetSmart(name) || s.Statable.IsInSetSmart(realPath(name))
} }
func (s *fileSets) isSoftBanFile(name *string) bool { func (s *fileSets) isSoftBanFile(name string) bool {
return s.SoftBan.IsInSetSmart(*name) || s.SoftBan.IsInSetSmart(realPath(*name)) return s.SoftBan.IsInSetSmart(name) || s.SoftBan.IsInSetSmart(realPath(name))
} }
func (s *fileSets) addFilePermission(name string, mode filePerm) { func (s *fileSets) addFilePermission(name string, mode filePerm) {
@ -137,7 +137,7 @@ func (s *fileSets) addFilePermission(name string, mode filePerm) {
} else if mode == filePermStat { } else if mode == filePermStat {
s.Statable.Add(name) s.Statable.Add(name)
} }
for name = dirname(&name); name != ""; name = dirname(&name) { for name = dirname(name); name != ""; name = dirname(name) {
s.Statable.Add(name) s.Statable.Add(name)
} }
} }

View File

@ -43,9 +43,10 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
} }
onDgsFileDetect := func(ctx *tracer.Context, name string) tracer.TraceAction { onDgsFileDetect := func(ctx *tracer.Context, name string) tracer.TraceAction {
if fs.isSoftBanFile(&name) { if fs.isSoftBanFile(name) {
return softBanSyscall(ctx) return softBanSyscall(ctx)
} }
print("Dangerous fileopen: (killed)", name)
return tracer.TraceKill return tracer.TraceKill
} }
@ -58,11 +59,11 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
print("open: ", fn, getFileMode(flags)) print("open: ", fn, getFileMode(flags))
if isReadOnly { if isReadOnly {
if realPath(fn) != "" && !fs.isReadableFile(&fn) { if realPath(fn) != "" && !fs.isReadableFile(fn) {
return onDgsFileDetect(ctx, fn) return onDgsFileDetect(ctx, fn)
} }
} else { } else {
if realPath(fn) != "" && !fs.isWritableFile(&fn) { if realPath(fn) != "" && !fs.isWritableFile(fn) {
return onDgsFileDetect(ctx, fn) return onDgsFileDetect(ctx, fn)
} }
} }
@ -72,7 +73,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
checkRead := func(ctx *tracer.Context, addr uint) tracer.TraceAction { checkRead := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
fn := ctx.GetString(uintptr(addr)) fn := ctx.GetString(uintptr(addr))
print("check read: ", fn) print("check read: ", fn)
if !fs.isReadableFile(&fn) { if !fs.isReadableFile(fn) {
return onDgsFileDetect(ctx, fn) return onDgsFileDetect(ctx, fn)
} }
return tracer.TraceAllow return tracer.TraceAllow
@ -81,7 +82,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
checkWrite := func(ctx *tracer.Context, addr uint) tracer.TraceAction { checkWrite := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
fn := ctx.GetString(uintptr(addr)) fn := ctx.GetString(uintptr(addr))
print("check write: ", fn) print("check write: ", fn)
if !fs.isWritableFile(&fn) { if !fs.isWritableFile(fn) {
return onDgsFileDetect(ctx, fn) return onDgsFileDetect(ctx, fn)
} }
return tracer.TraceAllow return tracer.TraceAllow
@ -90,7 +91,7 @@ func getHandle(t *tracer.Tracer, pType string, addRead []string, addWrite []stri
checkStat := func(ctx *tracer.Context, addr uint) tracer.TraceAction { checkStat := func(ctx *tracer.Context, addr uint) tracer.TraceAction {
fn := ctx.GetString(uintptr(addr)) fn := ctx.GetString(uintptr(addr))
print("check stat: ", fn) print("check stat: ", fn)
if !fs.isStatableFile(&fn) { if !fs.isStatableFile(fn) {
return onDgsFileDetect(ctx, fn) return onDgsFileDetect(ctx, fn)
} }
return tracer.TraceAllow return tracer.TraceAllow

View File

@ -85,8 +85,10 @@ func main() {
if !ok { if !ok {
c = tracer.TraceCodeFatal c = tracer.TraceCodeFatal
} }
// Handle fatal error from trace
fmt.Fprintf(f, "%d %d %d %d\n", int(c), rt.UserTime, rt.UserMem, rt.ExitCode) if rt != nil {
fmt.Fprintf(f, "%d %d %d %d\n", int(c), rt.UserTime, rt.UserMem, rt.ExitCode)
}
if c == tracer.TraceCodeFatal { if c == tracer.TraceCodeFatal {
os.Exit(1) os.Exit(1)
} }

View File

@ -111,10 +111,10 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
// check tle / mle // check tle / mle
if rt.UserTime > r.TimeLimit*1e3 { if rt.UserTime > r.TimeLimit*1e3 {
return nil, TraceCodeTLE return &rt, TraceCodeTLE
} }
if rt.UserMem > r.MemoryLimit<<10 { if rt.UserMem > r.MemoryLimit<<10 {
return nil, TraceCodeMLE return &rt, TraceCodeMLE
} }
// check process status // check process status
@ -127,7 +127,7 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
rt.ExitCode = wstatus.ExitStatus() rt.ExitCode = wstatus.ExitStatus()
return &rt, nil return &rt, nil
} }
return nil, TraceCodeFatal return &rt, TraceCodeFatal
} }
continue continue
@ -137,13 +137,13 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
if pid == rootPid { if pid == rootPid {
switch sig { switch sig {
case unix.SIGXCPU: case unix.SIGXCPU:
return nil, TraceCodeTLE return &rt, TraceCodeTLE
case unix.SIGXFSZ: case unix.SIGXFSZ:
return nil, TraceCodeOLE return &rt, TraceCodeOLE
case unix.SIGSYS: case unix.SIGSYS:
return nil, TraceCodeBan return &rt, TraceCodeBan
default: default:
return nil, TraceCodeRE return &rt, TraceCodeRE
} }
} else { } else {
delete(pids, pid) delete(pids, pid)
@ -158,7 +158,7 @@ func (r *Tracer) StartTrace() (result *TraceResult, err error) {
// give the customized handle for syscall // give the customized handle for syscall
err := r.handleTrap(pid) err := r.handleTrap(pid)
if err != nil { if err != nil {
return nil, err return &rt, err
} }
} }