diff options
Diffstat (limited to 'executor')
| -rw-r--r-- | executor/executor.cc | 28 |
1 files changed, 27 insertions, 1 deletions
diff --git a/executor/executor.cc b/executor/executor.cc index a8804994a..a266f54c1 100644 --- a/executor/executor.cc +++ b/executor/executor.cc @@ -16,6 +16,7 @@ #include <sys/stat.h> #include <sys/mman.h> #include <pthread.h> +#include <grp.h> #include <algorithm> #include "syscalls.h" @@ -45,6 +46,7 @@ bool flag_debug; bool flag_cover; bool flag_threaded; bool flag_deduplicate; +bool flag_drop_privs; __attribute__((aligned(64 << 10))) char input_data[kMaxInput]; __attribute__((aligned(64 << 10))) char output_data[kMaxOutput]; @@ -81,6 +83,7 @@ int cover_fd; __attribute__((noreturn)) void fail(const char* msg, ...); __attribute__((noreturn)) void error(const char* msg, ...); +__attribute__((noreturn)) void exitf(const char* msg, ...); void debug(const char* msg, ...); uint64_t read_input(uint64_t** input_posp); uint64_t read_arg(uint64_t** input_posp); @@ -111,6 +114,7 @@ int main() flag_cover = flags & (1 << 1); flag_threaded = flags & (1 << 2); flag_deduplicate = flags & (1 << 3); + flag_drop_privs = flags & (1 << 4); output_pos = (uint32_t*)&output_data[0]; write_output(0); // Number of executed syscalls (updated later). @@ -118,6 +122,16 @@ int main() if (!flag_threaded) cover_init(&threads[0]); + if (flag_drop_privs) { + // TODO: 65534 is meant to be nobody + if (setgroups(0, NULL)) + fail("failed to setgroups"); + if (setresgid(65534, 65534, 65534)) + fail("failed to setresgid"); + if (setresuid(65534, 65534, 65534)) + fail("failed to setresuid"); + } + int call_index = 0; for (int n = 0;; n++) { uint64_t call_num = read_input(&input_pos); @@ -212,7 +226,7 @@ thread_t* schedule_call(int n, int call_index, int call_num, uint64_t num_args, th->handled = true; if (flag_threaded) { if (pthread_create(&th->th, 0, worker_thread, th)) - fail("pthread_create failed"); + exitf("pthread_create failed"); } } if (__atomic_load_n(&th->done, __ATOMIC_ACQUIRE)) { @@ -496,6 +510,18 @@ void error(const char* msg, ...) exit(68); } +// just exit (e.g. due to temporal ENOMEM error) +void exitf(const char* msg, ...) +{ + fflush(stdout); + va_list args; + va_start(args, msg); + vfprintf(stderr, msg, args); + va_end(args); + fprintf(stderr, "\n"); + exit(1); +} + void debug(const char* msg, ...) { if (!flag_debug) |