mirror of
https://github.com/bdnugget/kcgi.git
synced 2026-11-07 05:47:27 +00:00
Remove last vestiges of XWARN[X] from system and remove the macros too.
This commit is contained in:
1 parent
2fcaae3bf5
commit
92c0cef530
4 files changed
+34
-38
No files matched your search
@@ -120,11 +120,6 @@ char *kxstrdup(const char *, int, const char *);
|
||||
#define XSTRDUP(_p) \
|
||||
kxstrdup(__FILE__, __LINE__, (_p))
|
||||
|
||||
#define XWARN(...) \
|
||||
kutil_warn(NULL, NULL, __VA_ARGS__)
|
||||
#define XWARNX(...) \
|
||||
kutil_warnx(NULL, NULL, __VA_ARGS__)
|
||||
|
||||
__END_DECLS
|
||||
|
||||
#endif
|
||||
+10
-10
@@ -35,14 +35,14 @@ ksandbox_darwin_init_child(enum sandtype type)
|
||||
char *er;
|
||||
struct rlimit rl_zero;
|
||||
|
||||
rc = SAND_WORKER == type ?
|
||||
rc = type == SAND_WORKER ?
|
||||
sandbox_init(kSBXProfilePureComputation,
|
||||
SANDBOX_NAMED, &er) :
|
||||
sandbox_init(kSBXProfileNoWrite,
|
||||
SANDBOX_NAMED, &er);
|
||||
|
||||
if (0 != rc) {
|
||||
XWARNX("sandbox_init: %s", er);
|
||||
if (rc != 0) {
|
||||
kutil_warn(NULL, NULL, "sandbox_init: %s", er);
|
||||
sandbox_free_error(er);
|
||||
rc = 0;
|
||||
} else
|
||||
@@ -56,15 +56,15 @@ ksandbox_darwin_init_child(enum sandtype type)
|
||||
* EPERM no matter what (the same code runs fine when not run as
|
||||
* a CGI instance).
|
||||
*/
|
||||
if (-1 == setrlimit(RLIMIT_NOFILE, &rl_zero))
|
||||
XWARN("setrlimit: rlimit_fsize");
|
||||
if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
|
||||
kutil_warn(NULL, NULL, "setrlimit");
|
||||
#endif
|
||||
if (-1 == setrlimit(RLIMIT_FSIZE, &rl_zero))
|
||||
XWARN("setrlimit: rlimit_fsize");
|
||||
if (-1 == setrlimit(RLIMIT_NPROC, &rl_zero))
|
||||
XWARN("setrlimit: rlimit_nproc");
|
||||
if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
|
||||
kutil_warn(NULL, NULL, "setrlimit");
|
||||
if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
|
||||
kutil_warn(NULL, NULL, "setrlimit");
|
||||
|
||||
return(rc);
|
||||
return rc;
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
+8
-10
@@ -28,19 +28,17 @@
|
||||
int
|
||||
ksandbox_pledge_init_child(enum sandtype type)
|
||||
{
|
||||
const char *fl;
|
||||
const char *fl;
|
||||
|
||||
fl = "stdio";
|
||||
if (SAND_WORKER != type)
|
||||
fl = "stdio unix sendfd recvfd";
|
||||
fl = type != SAND_WORKER ?
|
||||
"stdio unix sendfd recvfd" :
|
||||
"stdio";
|
||||
|
||||
if (-1 == pledge(fl, NULL)) {
|
||||
XWARN("pledge: %s",
|
||||
SAND_WORKER != type ?
|
||||
"control" : "worker");
|
||||
return(0);
|
||||
if (pledge(fl, NULL) == -1) {
|
||||
kutil_warn(NULL, NULL, "pledge");
|
||||
return 0;
|
||||
}
|
||||
return(1);
|
||||
return 1;
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
+16
-13
@@ -271,43 +271,46 @@ ssh_sandbox_child_debugging(enum sandtype type)
|
||||
int
|
||||
ksandbox_seccomp_init_child(enum sandtype type)
|
||||
{
|
||||
struct rlimit rl_zero;
|
||||
int nnp_failed = 0;
|
||||
struct rlimit rl_zero;
|
||||
int nnp_failed = 0;
|
||||
|
||||
rl_zero.rlim_cur = rl_zero.rlim_max = 0;
|
||||
|
||||
/* Set rlimits for completeness if possible. */
|
||||
rl_zero.rlim_cur = rl_zero.rlim_max = 0;
|
||||
|
||||
if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
|
||||
XWARN("setrlimit(RLIMIT_FSIZE)");
|
||||
kutil_warn(NULL, NULL, "setrlimit");
|
||||
#if 0
|
||||
/*
|
||||
* Don't do like OpenSSH: we need to pass stuff back and forth
|
||||
* over pipes, and this will prevent that from happening.
|
||||
*/
|
||||
if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
|
||||
XWARN("setrlimit(RLIMIT_NOFILE)");
|
||||
kutil_warn(NULL, NULL, "setrlimit");
|
||||
#endif
|
||||
if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
|
||||
XWARN("setrlimit(RLIMIT_NPROC)");
|
||||
kutil_warn(NULL, NULL, "setrlimit");
|
||||
|
||||
#ifdef SANDBOX_SECCOMP_DEBUG
|
||||
ssh_sandbox_child_debugging(type);
|
||||
#endif
|
||||
|
||||
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
|
||||
XWARN("prctl(PR_SET_NO_NEW_PRIVS)");
|
||||
kutil_warn(NULL, NULL, "prctl");
|
||||
nnp_failed = 1;
|
||||
}
|
||||
|
||||
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
|
||||
SAND_WORKER != type ?
|
||||
&preauth_prog_ctrl :
|
||||
&preauth_prog_work) == -1)
|
||||
XWARN("prctl(PR_SET_SECCOMP)");
|
||||
SAND_WORKER != type ?
|
||||
&preauth_prog_ctrl : &preauth_prog_work) == -1)
|
||||
kutil_warn(NULL, NULL, "prctl");
|
||||
else if (nnp_failed) {
|
||||
XWARNX("SECCOMP_MODE_FILTER activated but "
|
||||
kutil_warnx("SECCOMP_MODE_FILTER activated but "
|
||||
"PR_SET_NO_NEW_PRIVS failed");
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
return(1);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
#endif
|
||||
Reference in new issue
Block a user