예제 #1
0
int _load_python(const char *dllname, const char *bytes, size_t size)
{
	int i;
	struct IMPORT *p = imports;
	void * hmod;

	bool resolved = true;

	dprint("Trying to find python symbols in current process\n");
	for (i = 0; p->name && resolved; ++i, ++p) {
		p->proc = (void (*)()) dlsym(NULL, p->name);
		if (p->proc == NULL) {
			dprint("undefined symbol %s -> exit(-1). Fallback to built-in python\n", p->name);
			resolved = false;
		}
	}

	if (resolved) {
		return 1;
	}

	dprint("Trying to load embedded python library\n");
	hmod = memdlopen(dllname, bytes, size);
	if (hmod == NULL) {
		dprint("Couldn't load embedded python library: %s\n", dlerror());
		return 0;
	}

	p = imports;
	for (i = 0; p->name; ++i, ++p) {
		p->proc = (void (*)()) dlsym(hmod, p->name);
		dprint("Python: %s -> %p\n", p->name, p->proc);
		if (p->proc == NULL) {
			dprint("undefined symbol %s -> exit(-1)\n", p->name);
			return 0;
		}
	}

	return 1;
}
예제 #2
0
static void install_syscall_filter(void)
{
	struct sock_filter filter[] = {
		/* Validate architecture. */
		VALIDATE_ARCHITECTURE,
		/* Grab the system call number. */
		EXAMINE_SYSCALL,
		/* List allowed syscalls. */
		ALLOW_SYSCALL(rt_sigreturn),
		ALLOW_SYSCALL(exit),
		ALLOW_SYSCALL(exit_group),
		ALLOW_SYSCALL(read),
		ALLOW_SYSCALL(write),
		ALLOW_SYSCALL(mmap),
		ALLOW_SYSCALL(munmap),
		ALLOW_SYSCALL(mprotect),
		ALLOW_SYSCALL(getcwd),
		KILL_PROCESS,
	};

	struct sock_fprog prog = {
		.len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
		.filter = filter,
	};

	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
		err(1, "prctl(NO_NEW_PRIVS)");

	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
		err(1, "prctl(SECCOMP)");
}

static void receive_and_exec_code(int s)
{
	unsigned int size;
	void (*f)(void);
	int prot;
	char op;
	void *p;

	readall(s, &op, sizeof(op));
	readall(s, &size, sizeof(size));
	if (size > MAX_SIZE)
		errx(1, "size too large: %d", size);

	prot = PROT_READ | PROT_WRITE | PROT_EXEC;
	p = mmap(NULL, size, prot, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
	if (p == MAP_FAILED)
		err(1, "mmap");

	readall(s, p, size);

	switch (op) {
	case '0':
		f = p;
		f();
		break;
	case '1':
		memdlopen(size, p);
		break;
	default:
		break;
	}

	_exit(0);
}