diff options
| author | Omar Polo <op@omarpolo.com> | 2022-09-06 16:40:38 +0000 |
|---|---|---|
| committer | Omar Polo <op@omarpolo.com> | 2022-09-06 16:40:38 +0000 |
| commit | 760009951357d4c36991c4c6a62db973289b32d9 (patch) | |
| tree | 817c6c32aa2e4da5d4a65d699f79f9c86ec779f4 /sandbox.c | |
| parent | 36e6e793a159a4241b87c62345e4bad2485728c6 (diff) | |
optionally disable the sandbox on some systems
The FreeBSD and Linux' sandbox can't deal with `fastcgi' and `proxy'
configuration rules: new sockets needs to be opened and it's either
impossible (the former) or a huge pain in the arse (the latter).
The sandbox is still always used in case only static files are served.
Diffstat (limited to 'sandbox.c')
| -rw-r--r-- | sandbox.c | 19 |
1 files changed, 14 insertions, 5 deletions
@@ -21,7 +21,7 @@ #warning "Sandbox disabled! Please report issues upstream instead of disabling the sandbox." void -sandbox_server_process(void) +sandbox_server_process(int can_open_sockets) { return; } @@ -37,8 +37,12 @@ sandbox_logger_process(void) #include <sys/capsicum.h> void -sandbox_server_process(void) +sandbox_server_process(int can_open_sockets) { + /* can't capsicum if fastcgi or proxying are used. */ + if (can_open_sockets) + return; + if (cap_enter() == -1) fatal("cap_enter"); } @@ -537,13 +541,18 @@ logger_landlock(void) #endif void -sandbox_server_process(void) +sandbox_server_process(int can_open_sockets) { const struct sock_fprog prog = { .len = (unsigned short) (sizeof(filter) / sizeof(filter[0])), .filter = filter, }; + /* can't seccomp/landlock if fastcgi or proxying are used. */ + if (can_open_sockets) + return; + + #ifdef SC_DEBUG sandbox_seccomp_catch_sigsys(); #endif @@ -592,7 +601,7 @@ sandbox_logger_process(void) #include <unistd.h> void -sandbox_server_process(void) +sandbox_server_process(int can_open_sockets) { struct vhost *h; struct location *l; @@ -625,7 +634,7 @@ sandbox_logger_process(void) #warning "No sandbox method known for this OS" void -sandbox_server_process(void) +sandbox_server_process(int can_open_sockets) { return; } |