1296619Sdes/* $OpenBSD: sandbox-pledge.c,v 1.1 2015/10/09 01:37:08 deraadt Exp $ */ 2296619Sdes/* 3296619Sdes * Copyright (c) 2015 Theo de Raadt <deraadt@openbsd.org> 4296619Sdes * 5296619Sdes * Permission to use, copy, modify, and distribute this software for any 6296619Sdes * purpose with or without fee is hereby granted, provided that the above 7296619Sdes * copyright notice and this permission notice appear in all copies. 8296619Sdes * 9296619Sdes * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10296619Sdes * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11296619Sdes * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12296619Sdes * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13296619Sdes * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14296619Sdes * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15296619Sdes * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16296619Sdes */ 17296619Sdes 18296619Sdes#include "includes.h" 19296619Sdes 20296619Sdes#ifdef SANDBOX_PLEDGE 21296619Sdes 22296619Sdes#include <sys/types.h> 23296619Sdes#include <sys/ioctl.h> 24296619Sdes#include <sys/syscall.h> 25296619Sdes#include <sys/socket.h> 26296619Sdes#include <sys/wait.h> 27296619Sdes 28296619Sdes#include <errno.h> 29296619Sdes#include <limits.h> 30296619Sdes#include <stdarg.h> 31296619Sdes#include <stdio.h> 32296619Sdes#include <stdlib.h> 33296619Sdes#include <unistd.h> 34296619Sdes#include <pwd.h> 35296619Sdes 36296619Sdes#include "log.h" 37296619Sdes#include "ssh-sandbox.h" 38296619Sdes#include "xmalloc.h" 39296619Sdes 40296619Sdesstruct ssh_sandbox { 41296619Sdes pid_t child_pid; 42296619Sdes}; 43296619Sdes 44296619Sdesstruct ssh_sandbox * 45296619Sdesssh_sandbox_init(struct monitor *m) 46296619Sdes{ 47296619Sdes struct ssh_sandbox *box; 48296619Sdes 49296619Sdes debug3("%s: preparing pledge sandbox", __func__); 50296619Sdes box = xcalloc(1, sizeof(*box)); 51296619Sdes box->child_pid = 0; 52296619Sdes 53296619Sdes return box; 54296619Sdes} 55296619Sdes 56296619Sdesvoid 57296619Sdesssh_sandbox_child(struct ssh_sandbox *box) 58296619Sdes{ 59296619Sdes if (pledge("stdio", NULL) == -1) 60296619Sdes fatal("%s: pledge()", __func__); 61296619Sdes} 62296619Sdes 63296619Sdesvoid 64296619Sdesssh_sandbox_parent_finish(struct ssh_sandbox *box) 65296619Sdes{ 66296619Sdes free(box); 67296619Sdes debug3("%s: finished", __func__); 68296619Sdes} 69296619Sdes 70296619Sdesvoid 71296619Sdesssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid) 72296619Sdes{ 73296619Sdes box->child_pid = child_pid; 74296619Sdes /* Nothing to do here */ 75296619Sdes} 76296619Sdes 77296619Sdes#endif /* SANDBOX_PLEDGE */ 78