ksgi

1
/*	$Id$ */
2
/*
3
 * Copyright (c) 2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
4
 *
5
 * Permission to use, copy, modify, and distribute this software for any
6
 * purpose with or without fee is hereby granted, provided that the above
7
 * copyright notice and this permission notice appear in all copies.
8
 *
9
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
 */
17
#include "config.h"
18

19
#if HAVE_SANDBOX_INIT
20

21
#include <sys/resource.h>
22

23
#include <sandbox.h>
24
#include <stdarg.h>
25
#include <stdint.h>
26
#include <stdlib.h>
27

28
#include "kcgi.h"
29
#include "extern.h"
30

31
int
32
ksandbox_darwin_init_child(enum sandtype type)
33
{
34
	int	 	 rc;
35
	char		*er;
36
	struct rlimit	 rl_zero;
37

38
	rc = type == SAND_WORKER ?
39
		sandbox_init(kSBXProfilePureComputation, 
40
			SANDBOX_NAMED, &er) :
41
		sandbox_init(kSBXProfileNoWrite, 
42
			SANDBOX_NAMED, &er);
43

44
	if (rc != 0) {
45
		kutil_warn(NULL, NULL, "sandbox_init: %s", er);
46
		sandbox_free_error(er);
47
		rc = 0;
48
	} else
49
		rc = 1;
50

51
	rl_zero.rlim_cur = rl_zero.rlim_max = 0;
52

53
#if 0
54
	/*
55
	 * This doesn't play with kutil_openlog.
56
	 */
57
	if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
58
		kutil_warn(NULL, NULL, "setrlimit");
59

60
	/*
61
	 * FIXME: I've taken out the RLIMIT_NOFILE setrlimit() because
62
	 * it causes strange behaviour.  On Mac OS X, it fails with
63
	 * EPERM no matter what (the same code runs fine when not run as
64
	 * a CGI instance).
65
	 */
66
	if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
67
		kutil_warn(NULL, NULL, "setrlimit");
68
#endif
69
	if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
70
		kutil_warn(NULL, NULL, "setrlimit");
71

72
	return rc;
73
}
74

75
#endif
76