woj/nsjail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Makefile/indent: add AlwaysBreakBeforeMultilineStrings:false

Browse Source
This commit is contained in:
Robert Swiecki 2023-09-19 20:31:57 +02:00
parent 2e27593482
commit 439606be70
9 changed files with 62 additions and 83 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -100,7 +100,7 @@ depend: all
.PHONY: indent .PHONY: indent
indent: indent:
clang-format -style="{BasedOnStyle: google, IndentWidth: 8, UseTab: Always, IndentCaseLabels: false, ColumnLimit: 100, AlignAfterOpenBracket: false, AllowShortFunctionsOnASingleLine: false}" -i -sort-includes $(SRCS_H) $(SRCS_CXX) clang-format -style="{BasedOnStyle: google, IndentWidth: 8, UseTab: Always, IndentCaseLabels: false, ColumnLimit: 100, AlignAfterOpenBracket: false, AllowShortFunctionsOnASingleLine: false, AlwaysBreakBeforeMultilineStrings: false}" -i -sort-includes $(SRCS_H) $(SRCS_CXX)
clang-format -style="{BasedOnStyle: google, IndentWidth: 4, UseTab: Always, ColumnLimit: 100}" -i $(SRCS_PROTO) clang-format -style="{BasedOnStyle: google, IndentWidth: 4, UseTab: Always, ColumnLimit: 100}" -i $(SRCS_PROTO)
# DO NOT DELETE THIS LINE -- make depend depends on it. # DO NOT DELETE THIS LINE -- make depend depends on it.

58
cmdline.cc
View File

@ -281,16 +281,15 @@ void logParams(nsjconf_t *nsjconf) {
break; break;
} }
LOG_I( LOG_I("Jail parameters: hostname:'%s', chroot:%s, process:'%s', "
"Jail parameters: hostname:'%s', chroot:%s, process:'%s', " "bind:[%s]:%d, "
"bind:[%s]:%d, " "max_conns:%u, max_conns_per_ip:%u, time_limit:%" PRId64
"max_conns:%u, max_conns_per_ip:%u, time_limit:%" PRId64 ", personality:%#lx, daemonize:%s, clone_newnet:%s, "
", personality:%#lx, daemonize:%s, clone_newnet:%s, " "clone_newuser:%s, clone_newns:%s, clone_newpid:%s, clone_newipc:%s, "
"clone_newuser:%s, clone_newns:%s, clone_newpid:%s, clone_newipc:%s, " "clone_newuts:%s, "
"clone_newuts:%s, " "clone_newcgroup:%s, clone_newtime:%s, keep_caps:%s, "
"clone_newcgroup:%s, clone_newtime:%s, keep_caps:%s, " "disable_no_new_privs:%s, "
"disable_no_new_privs:%s, " "max_cpus:%zu",
"max_cpus:%zu",
nsjconf->hostname.c_str(), QC(nsjconf->chroot), nsjconf->hostname.c_str(), QC(nsjconf->chroot),
nsjconf->exec_file.empty() ? nsjconf->argv[0].c_str() : nsjconf->exec_file.c_str(), nsjconf->exec_file.empty() ? nsjconf->argv[0].c_str() : nsjconf->exec_file.c_str(),
nsjconf->bindhost.c_str(), nsjconf->port, nsjconf->max_conns, nsjconf->max_conns_per_ip, nsjconf->bindhost.c_str(), nsjconf->port, nsjconf->max_conns, nsjconf->max_conns_per_ip,
@ -311,10 +310,9 @@ void logParams(nsjconf_t *nsjconf) {
(unsigned long)uid.inside_id, (unsigned long)uid.outside_id, uid.count, (unsigned long)uid.inside_id, (unsigned long)uid.outside_id, uid.count,
uid.is_newidmap ? "true" : "false"); uid.is_newidmap ? "true" : "false");
if (uid.outside_id == 0 && nsjconf->clone_newuser) { if (uid.outside_id == 0 && nsjconf->clone_newuser) {
LOG_W( LOG_W("Process will be UID/EUID=0 in the global user namespace, and "
"Process will be UID/EUID=0 in the global user namespace, and " "will "
"will " "have user root-level access to files");
"have user root-level access to files");
} }
} }
for (const auto &gid : nsjconf->gids) { for (const auto &gid : nsjconf->gids) {
@ -322,10 +320,9 @@ void logParams(nsjconf_t *nsjconf) {
(unsigned long)gid.inside_id, (unsigned long)gid.outside_id, gid.count, (unsigned long)gid.inside_id, (unsigned long)gid.outside_id, gid.count,
gid.is_newidmap ? "true" : "false"); gid.is_newidmap ? "true" : "false");
if (gid.outside_id == 0 && nsjconf->clone_newuser) { if (gid.outside_id == 0 && nsjconf->clone_newuser) {
LOG_W( LOG_W("Process will be GID/EGID=0 in the global user namespace, and "
"Process will be GID/EGID=0 in the global user namespace, and " "will "
"will " "have group root-level access to files");
"have group root-level access to files");
} }
} }
} }
@ -345,11 +342,10 @@ uint64_t parseRLimit(int res, const char *optarg, unsigned long mul) {
return cur.rlim_max; return cur.rlim_max;
} }
if (!util::isANumber(optarg)) { if (!util::isANumber(optarg)) {
LOG_F( LOG_F("RLIMIT %d needs a numeric or 'max'/'hard'/'def'/'soft'/'inf' "
"RLIMIT %d needs a numeric or 'max'/'hard'/'def'/'soft'/'inf' " "value "
"value " "('%s' "
"('%s' " "provided)",
"provided)",
res, optarg); res, optarg);
} }
errno = 0; errno = 0;
@ -389,11 +385,10 @@ static bool setupArgv(nsjconf_t *nsjconf, int argc, char **argv, int optind) {
if (nsjconf->use_execveat) { if (nsjconf->use_execveat) {
#if !defined(__NR_execveat) #if !defined(__NR_execveat)
LOG_E( LOG_E("Your nsjail is compiled without support for the execveat() "
"Your nsjail is compiled without support for the execveat() " "syscall, "
"syscall, " "yet you "
"yet you " "specified the --execute_fd flag");
"specified the --execute_fd flag");
return false; return false;
#endif /* !defined(__NR_execveat) */ #endif /* !defined(__NR_execveat) */
if ((nsjconf->exec_fd = TEMP_FAILURE_RETRY( if ((nsjconf->exec_fd = TEMP_FAILURE_RETRY(
@ -462,10 +457,9 @@ void setupUsers(nsjconf_t *nsjconf) {
std::string parseMACVlanMode(const char *optarg) { std::string parseMACVlanMode(const char *optarg) {
if (strcasecmp(optarg, "private") != 0 && strcasecmp(optarg, "vepa") != 0 && if (strcasecmp(optarg, "private") != 0 && strcasecmp(optarg, "vepa") != 0 &&
strcasecmp(optarg, "bridge") != 0 && strcasecmp(optarg, "passthru") != 0) { strcasecmp(optarg, "bridge") != 0 && strcasecmp(optarg, "passthru") != 0) {
LOG_F( LOG_F("macvlan mode can only be one of the values: "
"macvlan mode can only be one of the values: " "'private'/'vepa'/'bridge'/'passthru' ('%s' "
"'private'/'vepa'/'bridge'/'passthru' ('%s' " "provided).",
"provided).",
optarg); optarg);
} }
return std::string(optarg); return std::string(optarg);

5
contain.cc
View File

@ -127,9 +127,8 @@ static bool containTSC(nsjconf_t* nsjconf) {
return false; return false;
} }
#else /* defined(__x86_64__) || defined(__i386__) */ #else /* defined(__x86_64__) || defined(__i386__) */
LOG_W( LOG_W("prctl(PR_SET_TSC, PR_TSC_SIGSEGV) requested, but it's supported under "
"prctl(PR_SET_TSC, PR_TSC_SIGSEGV) requested, but it's supported under " "x86/x86-64 CPU architectures only. Ignoring it!");
"x86/x86-64 CPU architectures only. Ignoring it!");
#endif /* defined(__x86_64__) || defined(__i386__) */ #endif /* defined(__x86_64__) || defined(__i386__) */
} }
return true; return true;

10
cpu.cc
View File

@ -70,9 +70,8 @@ static void setRandomCpu(cpu_set_t* orig_mask, cpu_set_t* new_mask, size_t avail
n = getNthOnlineCpu(orig_mask, n); n = getNthOnlineCpu(orig_mask, n);
CPU_SET(n, new_mask); CPU_SET(n, new_mask);
LOG_D( LOG_D("Add CPU #%zu from the original mask=[%s] (size=%zu, available_cpus=%zu), new "
"Add CPU #%zu from the original mask=[%s] (size=%zu, available_cpus=%zu), new " "mask=[%s] (size=%zu)",
"mask=[%s] (size=%zu)",
n, listCpusInSet(orig_mask).c_str(), (size_t)CPU_COUNT(orig_mask), available_cpus, n, listCpusInSet(orig_mask).c_str(), (size_t)CPU_COUNT(orig_mask), available_cpus,
listCpusInSet(new_mask).c_str(), (size_t)CPU_COUNT(new_mask)); listCpusInSet(new_mask).c_str(), (size_t)CPU_COUNT(new_mask));
CPU_CLR(n, orig_mask); CPU_CLR(n, orig_mask);
@ -121,9 +120,8 @@ bool initCpu(nsjconf_t* nsjconf) {
available_cpus--; available_cpus--;
} }
LOG_D( LOG_D("Setting new CPU mask=[%s] with %zu allowed CPUs (max_cpus=%zu), %zu CPUs "
"Setting new CPU mask=[%s] with %zu allowed CPUs (max_cpus=%zu), %zu CPUs " "(CPU_COUNT=%zu) left mask=[%s]",
"(CPU_COUNT=%zu) left mask=[%s]",
listCpusInSet(new_mask.get()).c_str(), nsjconf->max_cpus, listCpusInSet(new_mask.get()).c_str(), nsjconf->max_cpus,
(size_t)CPU_COUNT(new_mask.get()), available_cpus, (size_t)CPU_COUNT(orig_mask.get()), (size_t)CPU_COUNT(new_mask.get()), available_cpus, (size_t)CPU_COUNT(orig_mask.get()),
listCpusInSet(orig_mask.get()).c_str()); listCpusInSet(orig_mask.get()).c_str());

12
mnt.cc
View File

@ -214,10 +214,9 @@ static bool mountPt(mount_t* mpt, const char* newroot, const char* tmpdir) {
*/ */
if (mountRWIfPossible(mpt, srcpath, dstpath) == -1) { if (mountRWIfPossible(mpt, srcpath, dstpath) == -1) {
if (errno == EACCES) { if (errno == EACCES) {
PLOG_W( PLOG_W("mount('%s') src:'%s' dstpath:'%s' failed. "
"mount('%s') src:'%s' dstpath:'%s' failed. " "Try fixing this problem by applying 'chmod o+x' to the '%s' "
"Try fixing this problem by applying 'chmod o+x' to the '%s' " "directory and its ancestors",
"directory and its ancestors",
describeMountPt(*mpt).c_str(), srcpath, dstpath, srcpath); describeMountPt(*mpt).c_str(), srcpath, dstpath, srcpath);
} else { } else {
PLOG_W("mount('%s') src:'%s' dstpath:'%s' failed", PLOG_W("mount('%s') src:'%s' dstpath:'%s' failed",
@ -457,9 +456,8 @@ static bool initCloneNs(nsjconf_t* nsjconf) {
* proper capabilities are kept in the user namespace. It can be acheived by * proper capabilities are kept in the user namespace. It can be acheived by
* unmounting the new root and using setns to re-enter the mount namespace. * unmounting the new root and using setns to re-enter the mount namespace.
*/ */
LOG_W( LOG_W("Using no_pivotroot is escapable when user posseses relevant capabilities, "
"Using no_pivotroot is escapable when user posseses relevant capabilities, " "Use it with care!");
"Use it with care!");
if (chdir(destdir->c_str()) == -1) { if (chdir(destdir->c_str()) == -1) {
PLOG_E("chdir(%s)", QC(*destdir)); PLOG_E("chdir(%s)", QC(*destdir));

5
net.cc
View File

@ -219,9 +219,8 @@ bool limitConns(nsjconf_t* nsjconf, int connsock) {
int getRecvSocket(const char* bindhost, int port) { int getRecvSocket(const char* bindhost, int port) {
if (port < 0 || port > 65535) { if (port < 0 || port > 65535) {
LOG_F( LOG_F("TCP port %d out of bounds (0 <= port <= 65535), specify one with --port "
"TCP port %d out of bounds (0 <= port <= 65535), specify one with --port " "<port>",
"<port>",
port); port);
} }

10
sandbox.cc
View File

@ -60,17 +60,15 @@ static bool prepareAndCommit(nsjconf_t* nsjconf) {
} }
if (nsjconf->seccomp_log) { if (nsjconf->seccomp_log) {
#ifndef __NR_seccomp #ifndef __NR_seccomp
LOG_E( LOG_E("The __NR_seccomp is not defined with this kernel's header files (kernel "
"The __NR_seccomp is not defined with this kernel's header files (kernel " "headers too old?)");
"headers too old?)");
return false; return false;
#else #else
if (util::syscall(__NR_seccomp, (uintptr_t)SECCOMP_SET_MODE_FILTER, if (util::syscall(__NR_seccomp, (uintptr_t)SECCOMP_SET_MODE_FILTER,
(uintptr_t)(SECCOMP_FILTER_FLAG_TSYNC | SECCOMP_FILTER_FLAG_LOG), (uintptr_t)(SECCOMP_FILTER_FLAG_TSYNC | SECCOMP_FILTER_FLAG_LOG),
(uintptr_t)&nsjconf->seccomp_fprog) == -1) { (uintptr_t)&nsjconf->seccomp_fprog) == -1) {
PLOG_E( PLOG_E("seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC | "
"seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC | " "SECCOMP_FILTER_FLAG_LOG) failed");
"SECCOMP_FILTER_FLAG_LOG) failed");
return false; return false;
} }
return true; return true;

38
subproc.cc
View File

@ -287,10 +287,9 @@ static void seccompViolation(nsjconf_t* nsjconf, siginfo_t* si) {
const auto& p = nsjconf->pids.find(si->si_pid); const auto& p = nsjconf->pids.find(si->si_pid);
if (p == nsjconf->pids.end()) { if (p == nsjconf->pids.end()) {
LOG_W( LOG_W("pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld (If "
"pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld (If " "SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible "
"SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible " "auditd report with more data)",
"auditd report with more data)",
(int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime, (int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime,
(long)si->si_stime); (long)si->si_stime);
LOG_E("Couldn't find pid element in the subproc list for pid=%d", (int)si->si_pid); LOG_E("Couldn't find pid element in the subproc list for pid=%d", (int)si->si_pid);
@ -300,10 +299,9 @@ static void seccompViolation(nsjconf_t* nsjconf, siginfo_t* si) {
char buf[4096]; char buf[4096];
ssize_t rdsize = util::readFromFd(p->second.pid_syscall_fd, buf, sizeof(buf) - 1); ssize_t rdsize = util::readFromFd(p->second.pid_syscall_fd, buf, sizeof(buf) - 1);
if (rdsize < 1) { if (rdsize < 1) {
LOG_W( LOG_W("pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld (If "
"pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld (If " "SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible "
"SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible " "auditd report with more data)",
"auditd report with more data)",
(int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime, (int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime,
(long)si->si_stime); (long)si->si_stime);
return; return;
@ -315,23 +313,20 @@ static void seccompViolation(nsjconf_t* nsjconf, siginfo_t* si) {
int ret = sscanf(buf, "%td %tx %tx %tx %tx %tx %tx %tx %tx", &sc, &arg1, &arg2, &arg3, int ret = sscanf(buf, "%td %tx %tx %tx %tx %tx %tx %tx %tx", &sc, &arg1, &arg2, &arg3,
&arg4, &arg5, &arg6, &sp, &pc); &arg4, &arg5, &arg6, &sp, &pc);
if (ret == 9) { if (ret == 9) {
LOG_W( LOG_W("pid=%d, Syscall number:%td, Arguments:%#tx, %#tx, %#tx, %#tx, %#tx, %#tx, "
"pid=%d, Syscall number:%td, Arguments:%#tx, %#tx, %#tx, %#tx, %#tx, %#tx, " "SP:%#tx, PC:%#tx, si_status:%d",
"SP:%#tx, PC:%#tx, si_status:%d",
(int)si->si_pid, sc, arg1, arg2, arg3, arg4, arg5, arg6, sp, pc, si->si_status); (int)si->si_pid, sc, arg1, arg2, arg3, arg4, arg5, arg6, sp, pc, si->si_status);
} else if (ret == 3) { } else if (ret == 3) {
LOG_W( LOG_W("pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld SP:%#tx, PC:%#tx (If "
"pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld SP:%#tx, PC:%#tx (If " "SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible "
"SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible " "auditd report with more data)",
"auditd report with more data)",
(int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime, (int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime,
(long)si->si_stime, arg1, arg2); (long)si->si_stime, arg1, arg2);
return; return;
} else { } else {
LOG_W( LOG_W("pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld (If "
"pid=%d SiStatus:%d SiUid:%d SiUtime:%ld SiStime:%ld (If " "SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible "
"SiStatus==31 (SIGSYS), then see 'dmesg' or 'journalctl -ek' for possible " "auditd report with more data)",
"auditd report with more data)",
(int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime, (int)si->si_pid, si->si_status, si->si_uid, (long)si->si_utime,
(long)si->si_stime); (long)si->si_stime);
} }
@ -545,9 +540,8 @@ pid_t cloneProc(uint64_t flags, int exit_signal) {
} }
if (flags & CLONE_NEWTIME) { if (flags & CLONE_NEWTIME) {
LOG_W( LOG_W("CLONE_NEWTIME reuqested, but it's only supported with the unshare() mode "
"CLONE_NEWTIME reuqested, but it's only supported with the unshare() mode " "(-Me)");
"(-Me)");
} }
#if defined(__NR_clone3) #if defined(__NR_clone3)

5
util.cc
View File

@ -231,9 +231,8 @@ static void rndInitThread(void) {
#endif /* defined(__NR_getrandom) */ #endif /* defined(__NR_getrandom) */
int fd = TEMP_FAILURE_RETRY(open("/dev/urandom", O_RDONLY | O_CLOEXEC)); int fd = TEMP_FAILURE_RETRY(open("/dev/urandom", O_RDONLY | O_CLOEXEC));
if (fd == -1) { if (fd == -1) {
PLOG_D( PLOG_D("Couldn't open /dev/urandom for reading. Using gettimeofday "
"Couldn't open /dev/urandom for reading. Using gettimeofday " "fall-back");
"fall-back");
struct timeval tv; struct timeval tv;
gettimeofday(&tv, NULL); gettimeofday(&tv, NULL);
rndX = tv.tv_usec + ((uint64_t)tv.tv_sec << 32); rndX = tv.tv_usec + ((uint64_t)tv.tv_sec << 32);