passt: Relicense to GPL 2.0, or any later version
In practical terms, passt doesn't benefit from the additional
protection offered by the AGPL over the GPL, because it's not
suitable to be executed over a computer network.
Further, restricting the distribution under the version 3 of the GPL
wouldn't provide any practical advantage either, as long as the passt
codebase is concerned, and might cause unnecessary compatibility
dilemmas.
Change licensing terms to the GNU General Public License Version 2,
or any later version, with written permission from all current and
past contributors, namely: myself, David Gibson, Laine Stump, Andrea
Bolognani, Paul Holzinger, Richard W.M. Jones, Chris Kuhn, Florian
Weimer, Giuseppe Scrivano, Stefan Hajnoczi, and Vasiliy Ulyanov.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-04-05 20:11:44 +02:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-or-later
|
2022-09-12 14:24:03 +02:00
|
|
|
* Copyright Red Hat
|
|
|
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
|
* Author: David Gibson <david@gibson.dropbear.id.au>
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#ifndef ISOLATION_H
|
|
|
|
|
#define ISOLATION_H
|
|
|
|
|
|
passt, util: Close any open file that the parent might have leaked
If a parent accidentally or due to implementation reasons leaks any
open file, we don't want to have access to them, except for the file
passed via --fd, if any.
This is the case for Podman when Podman's parent leaks files into
Podman: it's not practical for Podman to close unrelated files before
starting pasta, as reported by Paul.
Use close_range(2) to close all open files except for standard streams
and the one from --fd.
Given that parts of conf() depend on other files to be already opened,
such as the epoll file descriptor, we can't easily defer this to a
more convenient point, where --fd was already parsed. Introduce a
minimal, duplicate version of --fd parsing to keep this simple.
As we need to check that the passed --fd option doesn't exceed
INT_MAX, because we'll parse it with strtol() but file descriptor
indices are signed ints (regardless of the arguments close_range()
take), extend the existing check in the actual --fd parsing in conf(),
also rejecting file descriptors numbers that match standard streams,
while at it.
Suggested-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Paul Holzinger <pholzing@redhat.com>
2024-08-06 20:32:11 +02:00
|
|
|
void isolate_initial(int argc, char **argv);
|
2022-10-14 06:25:34 +02:00
|
|
|
void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns,
|
|
|
|
|
enum passt_modes mode);
|
2023-09-29 07:50:19 +02:00
|
|
|
int isolate_prefork(const struct ctx *c);
|
2022-10-14 06:25:31 +02:00
|
|
|
void isolate_postfork(const struct ctx *c);
|
2022-09-12 14:24:03 +02:00
|
|
|
|
|
|
|
|
#endif /* ISOLATION_H */
|