Warning: Cannot modify header information - headers already sent by (output started at /var/www/jonas-eriksen.dk/pic/private/index.php:1) in /var/www/jonas-eriksen.dk/pic/private/index.php on line 215
PK !
A; lveinfo.ver.cagefs/lveinfo.vernu [ V njPK ! a=,2 ,2 lve-ctl.hnu [ #ifndef _LVE_CTL_H_
#define _LVE_CTL_H_
#include
#include
#include
#ifndef _LVE_TYPE_H_
#include "lve-type.h"
#endif
#define LIBLVE_API_MAJOR 1
#define LIBLVE_API_MINOR 5
#define SIZEOF_LIBLVE (sizeof(void *) + sizeof(void *) + sizeof(int))
struct liblve;
/**
* initializes and create instance of LVE
* args
* allocator - pointer to function to allocate memory
* returns
* NULL on error, errno will be set.
* errno will be EINVAL if wrong version of library is used
* liblve otherwise
*/
struct liblve *init_lve(liblve_alloc alloc, liblve_free free);
static inline struct liblve *init_lve_generic()
{
return init_lve(malloc, free);
}
/**
* destroy lve library instance
* args:
* lve = instantiated liblive instance
* return 0 on success
* negative number on error. errno will be set
*/
int destroy_lve(struct liblve *lve);
/**
* enter a light virutal environment
* args:
* lve = fully initialized liblve instance
* lve_id = id associated with LVE
* cookie = pointer to cookie, which is returned if the task
* is correctly migrated into LVE and used to exit from this LVE
* return codes:
* 0 = on success, negative number means error:
* -EPERM - don't have permission to call, or called from outside root LVE
* -ENOMEM - there's not enough memory to allocate a new LVE
* -EFAULT - cookie is a bad pointer
*/
int lve_enter_flags(struct liblve *lve,
uint32_t lve_id, uint32_t *cookie,
enum liblve_enter_flags flags);
/**
* enter lve namespace and get a copy of the original fs
* args:
* lve = fully initialized liblve instance
* return codes:
* -EINVAL - the caller hasn't entered an lve
*/
int lve_enter_fs(struct liblve *lve);
/**
* exit from virtual environment, same as lve_leave
* args:
* lve = fully init liblve instance
* cookie - pointer to cookie returned from lve_enter
* return codes:
* 0 = none error, all less zero is errors:
* -ESRCH = task not in virutal environment
* -EFAULT = bad cookie pointer
* -EINVAL = cookie not match to stored in context
*/
int lve_exit(struct liblve *lve, uint32_t *cookie);
int lve_setup_enter(struct liblve *lve, uint32_t ve_id,
struct liblve_settings *set,
uint32_t *cookie, enum liblve_enter_flags flags);
/**
* @brief Checks whether a current task has reached its limits.
*
* This call retrieve set of liblve_ve_fails flags, each of them
* represents resource which allocation failed. This flags combined
* via bitwise or returns through failmask parameter. Flags are
* cleared after this call.
*
* @param lve - fully initialized liblve instance.
* @param failmask - pointer to variable where fail mask will be stored.
* @retval 0 success.
* @retval -ESRCH task not in virutal environment.
* @retval -EFAULT bad failmask pointer.
*/
int lve_check_fault(struct liblve *lve, uint32_t * failmask);
#ifdef LVE_DEPRICATED
#warning you need remove old functions
static inline int lve_is_available(void)
{
struct liblve *lve;
lve = init_lve(malloc, free);
if (lve == NULL)
return 0;
destroy_lve(lve);
return 1;
}
static inline int lve_instance_init(struct liblve *lve)
{
struct liblve *tmp;
if (lve == NULL)
return SIZEOF_LIBLVE;
tmp = init_lve(malloc, NULL);
if (tmp == NULL)
return -1;
memcpy(lve, tmp, SIZEOF_LIBLVE);
free(tmp);
return 0;
}
static inline int lve_instance_destroy(struct liblve *lve)
{
return destroy_lve(lve);
}
#define __unused __attribute__((unused))
static inline int lve_enter(struct liblve *lve,
uint32_t ve_id, __unused int32_t uid,
__unused int32_t gid, uint32_t *cookie)
{
return lve_enter_flags(lve, ve_id, cookie, 0);
}
static inline int lve_leave(struct liblve *lib, uint32_t *cookie)
{
return lve_exit(lib, cookie);
}
#endif
/**
* Return 1 if process in lve context
* return
* 1 - process is in lve context
* 0 - process is not in lve context
*/
int is_in_lve(struct liblve *lve);
/**
* return actual api version used to communicate with kernel
* in format major << 16 | minor
*/
uint32_t lve_kapi_ver(struct liblve *lve);
/**
* return actual liblve api version used to communicate with
* userland application
* return in format major << 16 | minor
*/
uint32_t lve_get_api_version(void);
#ifdef LVE_ADMIN
/**
* create custom configured virtual enviroment
* args:
* ve_id = id associated with VE
*/
int lve_create(struct liblve *lve, uint32_t lve_id);
/**
* destroy configured virtual environment
* args:
* ve_id = id associated with VE
*/
int lve_destroy(struct liblve *lve, uint32_t lve_id);
/**
* adjust parameters for virtual environment
* args:
* ve_id = id associated with VE
*/
int lve_setup(struct liblve *lve, uint32_t lve_id,
struct liblve_settings *set);
/**
* flush context's from kernel
* args
* all == true - is need all context flushed, or only default
* configured
* return
*
*/
int lve_flush(struct liblve *lve, int all);
/**
* get info about context
* args
* ve_id = id associated with VE
* cpu - pointer to return CPU power.
* io - pointer to IO priority.
* return
* 0 - OK
* any negative value say error is hit.
*/
int lve_info(struct liblve *lve, uint32_t ve_id, struct liblve_info *set);
int lve_setup_flags(struct liblve *lve, uint32_t ve_id, enum liblve_ve_flags);
/**
* migrate existent process into container
*
* args
* ve_id = container id to migrate
* pid = process id to migrate
* return
* 0 - OK
* any negative value say error is hit.
*/
int lve_enter_pid(struct liblve *lve, uint32_t ve_id, pid_t pid);
/**
* migrate existent process into container with flags
*
* args
* ve_id = container id to migrate
* pid = process id to migrate
* flags = flag set, see lve_enter
* return
* 0 - OK
* < 0 - for -errno.
*/
int lve_enter_pid_flags(struct liblve *lve, uint32_t ve_id,
pid_t pid, uint32_t flags);
/**
* migrate existent process from container
*
* args
* pid = process id to migrate
* return
* 0 - OK
* any negative value say error is hit.
*/
int lve_leave_pid(struct liblve *lve, pid_t pid);
/**
* Set up the lve module
* returns
* 0 on success
* -errno on error
*/
int lve_start(struct liblve *lve);
/**
* Set fail injection place
*/
int lve_set_fail_val(struct liblve *lve, uint32_t fail_val);
/**
* enter lve namespace and get the ORIGINAL fs
* any changes to cwd/root will be applied to all
* following namespace guests
* args:
* lve = fully initialized liblve instance
* \retval
* -EPERM - the call is not permitted
* -EINVAL - the caller hasn't entered an lve
*/
int lve_setup_fs(struct liblve *lve);
/**
* set lve root mount tree.
* args
* lve = fully initialized liblve instance
* lve_id = lve identiferer to be root changed
*
* \retval
*/
int lve_set_root(struct liblve *lve, uint32_t lve_id, const char *root);
/**
* take current NS and FS settrigs as default for lve.
* args
* lve = fully initialized liblve instance
* lve_id = lve identifer to need assign an NS
* \retval
*
*/
int lve_assign_ns(struct liblve *lve, uint32_t lve_id);
/**
* set lve global parameter value
* args
* lve = fully initialized liblve instance
* param parameter id
* val = parameter value
* \retval
*/
int lve_set_global_param(struct liblve *lve,
enum liblve_global_params param, uint64_t val);
/**
* get lve global parameter value
* args
* lve = fully initialized liblve instance
* param parameter id
* val = parameter value
* \retval
*/
int lve_get_global_param(struct liblve *lve,
enum liblve_global_params param, uint64_t *val);
/**
* get lve info by task pid
* args
* lve = fully initialized liblve instance
* pid = task PID
* info = pointer where to put info
* \retval
*/
int lve_get_pid_info(struct liblve *lve, pid_t pid, struct liblve_pid_info *info);
/**
* TCP port bind control
* args
* lve = fully initialized liblve instance
*
* \retval
*/
/* helpers */
int lve_net_port_add(struct liblve *lve, uint32_t lve_id, uint16_t port, bool policy);
int lve_net_port_del(struct liblve *lve, uint32_t lve_id, uint16_t port);
int lve_net_port_def(struct liblve *lve, uint32_t lve_id, bool policy);
/**
* set network limits
* args
* lve = fully initialized liblve instance
* net_limits = uid/port pair
* \retval
*/
int lve_set_net_limits(struct liblve *lve, uint32_t lve_id,
struct liblve_net_limits *net_limits);
/**
* control freezer
* args
* lve = fully initialized liblve instance
* fc = arguments passed to the freezer
* \retval
*/
int lve_freezer_control(struct liblve *lve, uint32_t lve_id,
struct liblve_freezer_control *fc);
/**
* create 2nd level lvp
* args
* lve = fully initialized liblve instance
* lvp_id = lvp identifier
*/
int lve_lvp_create(struct liblve *lve, uint32_t lvp_id);
/**
* create a nested LVP under a parent LVP
* args
* lve = fully initialized liblve instance
* lvp_id = new lvp identifier
* parent_lvp_id = parent lvp identifier (0 for root)
*/
int lve_lvp_create2(struct liblve *lve, uint32_t lvp_id, uint32_t parent_lvp_id);
/**
* adjust parameters for virtual environment
* args:
* lve = initialized liblve entity
* set = default parameters settings
* lvp_id = id associated with resseler
*/
int lve_lvp_setup(struct liblve *lve, uint32_t lvp_id, enum lvp_set_type op,
struct liblve_settings *set);
/**
* destroy 2nd level lvp
* args
* lve = fully initialized liblve instance
* lvp_id - lvp identifier
*/
int lve_lvp_destroy(struct liblve *lve, uint32_t lvp_id);
/* create a mapping between lve and lvp */
int lve_lvp_map(struct liblve *lve, uint32_t lve_id, uint32_t lvp_id);
/**
* move lvp to the different reseller
*/
int lve_lvp_move(struct liblve *lve, uint32_t lve_id, uint32_t lvp_id);
/**
* read lvp limits
*/
int lve_lvp_info(struct liblve *lve, uint32_t lvp_id, enum lvp_set_type op,
struct liblve_info *set);
#endif
struct passwd;
/**
* CageFS definitions
*/
#include
#include
#define SECURELVE_JAIL "/usr/share/cagefs-skeleton"
#define SECURELVE_BASEDIR "/var/cagefs/"
#define SECURELVE_SHELL "/usr/sbin/securelve_sh" /* deprecated */
#define SECURELVE_ETC_MP_FILE "/etc/cagefs/cagefs.mp"
#define SECURELVE_MP_FILE "/usr/share/cagefs/cagefs.mp.work" /* deprecated */
#define SECURELVE_CONFIG_DIR "/etc/cagefs"
#define SECURELVE_MIN_UID 500
#define SECURELVE_MIN_UID_FILENAME "/etc/cagefs/cagefs.min.uid"
#define HOME_REGEX_FILE "/etc/cagefs/cagefs.base.home.dirs"
#define DISABLE_HOME_DIRS_SEARCH "/etc/cagefs/disable.home.dirs.search"
#define DEV_SHM_OPTIONS "/etc/cagefs/dev.shm.options"
/* Max count of regular expressions */
#define MAX_REXPS 100
#define DISABLE_ETCFS "/etc/cagefs/etc.safe/disable.etcfs"
#define PGSQL_SOCKET_CFG "/usr/share/cagefs/pgsql.socket.name"
#define MYSQL_SOCKET_CFG "/usr/share/cagefs/mysql.socket.name"
#define CL_SOLO "/etc/cloudlinux-edition-solo"
#define CL_CONTAINER "/etc/cloudlinux-container"
#define FEATURE_AVAIL_FLAG_DISABLE_RESTRICT_CAPS "/opt/cloudlinux/flags/available-flags.d/disable-cagefs-restricted-caps.flag"
#define FEATURE_ENABLE_FLAG_DISABLE_RESTRICT_CAPS "/opt/cloudlinux/flags/enabled-flags.d/disable-cagefs-restricted-caps.flag"
#define FEATURE_AVAIL_FLAG_DISABLE_NO_NEW_PRIVS "/opt/cloudlinux/flags/available-flags.d/disable-cagefs-no-new-privs.flag"
#define FEATURE_ENABLE_FLAG_DISABLE_NO_NEW_PRIVS "/opt/cloudlinux/flags/enabled-flags.d/disable-cagefs-no-new-privs.flag"
/*
Function reads MIN UID value from file
Returns -1 if error has occured
*/
int read_min_uid(unsigned int *min_uid, char *error_str);
/**
* puts user in CageFS (jail)
* return 1 if succesful, -1 if error, 0 if CageFS is disabled
*/
int jail(struct passwd *pw, char * error_str);
int lve_jail(struct passwd *pw, char * error_str);
int lve_jail_uid(struct passwd *pw, unsigned int min_uid, char *error_str);
/**
* A variant of the 'jail' function, but with additional enhancements:
* - allows LVE ID an to be passed as an argument, i.e. not be equal to user's UID.
* - allows flags to be passed to modify the behavior of the jail.
*/
int jail_enhanced(struct passwd * pw, uint32_t lve_id, uint32_t flags, char *error_str);
/**
* setup namespace for CageFS (jail)
* return 1 if succesful, -1 if error, 0 if CageFS is disabled
*/
int lve_namespace_setup(uint32_t lve_id);
/*
mount personal user's directories in CageFS
*/
int mount_jail(const char *homedir, const char *username, const char *basedir, const char *jaildir, char *error_str, uid_t uid, gid_t gid);
/*
helper function to strip slash in the end of path
*/
void strip_slash(char *str);
// Returns zero on success, or -1 if an error occurred
int make_dir(const char *target, mode_t mode, int make_parents, char *error_str);
int print_error(char *str, int err, const char *format, ...);
#endif
PK ! ړ
lve-type.hnu [ #ifndef _LVE_TYPE_H_
#define _LVE_TYPE_H_
#include
#include
#include
enum liblve_enter_flags {
LVE_NO_UBC = 1 << 0,
LVE_NO_NAMESPACE = 1 << 1,
LVE_NO_MAXENTER = 1 << 2,
LVE_SILENCE = 1 << 3,
LVE_NO_KILLABLE = 1 << 4,
LVE_NO_CPU = 1 << 5,
LVE_NO_FREEZER = 1 << 6,
};
enum liblve_ve_flags {
LVE_VE_DISABLE = 1 << 0, /* disable to enter to that ve */
};
enum liblve_ve_fails {
LVE_FAIL_MEM = 1 << 0, /**< memory limit reached */
LVE_FAIL_MEM_PHY = 1 << 1, /**< physical memory limit reached */
LVE_FAIL_NPROC = 1 << 2, /**< number of processes limit reached */
};
enum liblve_global_params {
LVEGP_SYMLINK_PROTECTION = 1,
LVEGP_HARDLINK_PROTECTION,
LVEGP_HANDLE_SYMLINK_OWNER,
LVEGP_SYMLINK_OWNER_GID,
LVEGP_SYMLINK_PROT_ALLOW_GID,
LVEGP_HARDLINK_PROT_ALLOW_GID,
LVEGP_GLOBAL_NONROOT,
LVEGP_XFS_QUOTA_CAP_RES_BYPASS,
LVEGP_PROC_CAN_SEE_OTHER_UID,
LVEGP_PROC_SUPER_GID,
LVEGP_PTRACE_ENABLED,
LVEGP_PTRACE_SELF_ENABLED,
LVEGP_GRACE_PERIOD = 125,
};
/**
* Flag indicating that ls_cpu stores hi resolution limit, used only for
* lve_setup_enter.
*/
#define LIBLVE_SETTINGS_LS_CPU_HIRES (1<<31)
struct liblve_settings {
int32_t ls_cpu; /** < cpu power aka rate */
int32_t ls_cpus; /** < number vcpus */
int32_t ls_io; /** < io limit */
int32_t ls_enters; /** < enter limit */
int32_t ls_memory; /** < mem limit */
int32_t ls_cpu_weight;
int32_t ls_memory_phy; /** < phy mem limit */
int32_t ls_nproc; /* number processes */
int32_t ls_iops; /* number of iops */
};
struct liblve_info {
struct liblve_settings li_set; /* if it's put on top we have binary
compatible with old versions */
enum liblve_ve_flags li_flags;
};
struct liblve_pid_info {
uint32_t id; /* lve id of the task */
uint32_t flags; /* flags task entered lve with */
bool leader; /* is lve leader */
};
struct liblve_net_port {
uint16_t port; /* port, 0 - change a lve policy itself */
bool permit; /* permit/forbid port binding */
};
struct liblve_net_limits {
uint64_t in_lim; /* input trafic limit */
uint64_t out_lim; /* output trafic limit */
};
enum liblve_freezer_ops {
LVE_FREEZER_FREEZE,
LVE_FREEZER_THAW,
};
struct liblve_freezer_control {
uint16_t op;
};
enum lvp_set_type {
LVP_SETUP_SELF,
LVP_SETUP_DEFAULT,
};
typedef void *(*liblve_alloc)(size_t size);
typedef void (*liblve_free)(void *ptr);
enum jail_flags {
JAIL_DROP_CAPS = 1 << 0,
JAIL_NO_NEW_PRIVS = 1 << 1,
};
#endif
PK !
+l
secureio.hnu [ // Secure I/O and filesystem operations
#ifndef _SECUREIO_H_
#define _SECUREIO_H_
#include
#define SECUREIO_BUFSIZE 8192
// Writes absolute path pointed by descriptor fd to buffer *buf
// Returns buf if successful
// Returns NULL if error has occured
char *get_path_from_descriptor(int fd, char *buf);
// Returns 1 if subdir is subdirectory of dir, 0 otherwise
int is_subdir(const char *dir, const char *subdir);
// Opens path for reading not following symlinks and verifies that opened path is inside parent_path
// Returns:
// descriptor if successful
// -1 if path does not exist or is a symlink
// -2 if opened path is NOT inside parent_path or cannot be determined
int open_not_symlink(const char *path, const char *parent_path);
// Closes descriptor (if it is > 0)
void closefd(int fd);
// Tries to read first directory entry in order to ensure that descriptor is valid
// Returns 0 if reading succeeded or -1 if error has occured
int check_dir(int fd);
// Checks if path is a directory (in secure manner)
// Also opens path (if descriptor fd == -1) and then checks that opened path is inside parent_path
// Returns descriptor if path refers to directory
// Returns -1 if path does not exist or is not a directory
// Returns -2 if opened path is NOT inside parent_path or cannot be determined
int isdir(const char *path, int fd, const char *parent_path);
// Sets permissions to directory (in secure manner)
// Returns descriptor if successful
// Returns -1 if error has occured
// Returns -2 if opened path is NOT inside parent_path or cannot be determined
int set_perm_dir_secure(const char *path, mode_t perm, int fd, const char *parent_path);
// Sets owner and group of directory (in secure manner)
// Returns descriptor if successful
// Returns -1 if error has occured
// Returns -2 if opened path is NOT inside parent_path or cannot be determined
int set_owner_dir_secure(const char *path, uid_t uid, gid_t gid, int fd, const char *parent_path);
// Creates directory if it does not exist, sets permissions/owner otherwise
// Returns descriptor if successful
// Returns -1 if error has occured
int create_dir_secure(const char *path, mode_t perm, uid_t uid, gid_t gid, int fd, const char *parent_path);
// Recursive directory creation function
// Returns 0 if successful
// Returns -1 if error has occured
int makedirs_secure(const char *path, mode_t perm, uid_t uid, gid_t gid, const char *parent_path);
#endif
PK ! |U setcap.hnu [ /* Library to set needed capabilities for current process */
#ifndef _SETCAP_H_
#define _SETCAP_H_
#include
// Switch on CAP_SYS_RESOURCE capabality to switch off disk quotas checking
//
// Returns 0 if successful
// Returns -1 if error has occured
int enable_quota_capability();
// Switch off CAP_SYS_RESOURCE capabality to switch off disk quotas checking
//
// Returns 0 if successful
// Returns -1 if error has occured
int disable_quota_capability();
#endif
PK ! ,2 lvd-map.hnu [ #ifndef _LVD_MAP_H_
#define _LVD_MAP_H_
#include
#include
/*
* LVD per-domain registry — single C implementation for liblve.so.
*
* Two file types live under LVD_MAP_DIR:
*
* Per-uid open-addressing hash table (docroot -> domain_id).
* The hot lookup path touches only this file — no locking,
* no .index access.
*
* .index Global next_id counter (12 bytes). Touched only on writes
* (assign/remove), under flock().
*
* Per-uid on-disk format (version 2):
*
* Header (16 bytes):
* magic[4] = "LVDM"
* version(u16) = 2
* count(u16) — number of occupied slots
* str_offset(u32)— byte offset from file start to string pool
* capacity(u32) — hash table slot count (power of 2)
*
* Hash table (capacity * 16 bytes, starts at byte 16):
* Per slot (16 bytes):
* hash(u32) — FNV-1a of docroot; 0 = empty slot
* key_offset(u32)— offset into string pool (from pool start)
* key_len(u32) — docroot string length (excluding NUL)
* domain_id(u32) — assigned domain LVE ID
*
* String pool (at str_offset):
* Packed null-terminated docroot strings
*
* Version 1 (legacy sorted-array format) is still accepted by
* lvd_map_lookup() for transparent migration.
*/
#define LVD_MAP_MAGIC "LVDM"
#define LVD_MAP_VERSION 2
#define LVD_MAP_DIR "/etc/container/lvd_ids"
/* Legacy format version for backward-compatible reads */
#define LVD_MAP_VERSION_V1 1
struct lvd_map_header {
char magic[4];
uint16_t version;
uint16_t count;
uint32_t str_offset;
uint32_t capacity; /* v2: hash table slot count; v1: reserved */
} __attribute__((packed));
struct lvd_map_slot {
uint32_t hash; /* FNV-1a of docroot; 0 = empty */
uint32_t key_offset; /* offset into string pool */
uint32_t key_len; /* docroot length (no NUL) */
uint32_t domain_id;
} __attribute__((packed));
/* Legacy v1 entry (12 bytes, sorted by docroot) */
struct lvd_map_entry_v1 {
uint32_t key_offset;
uint32_t key_len;
uint32_t domain_id;
} __attribute__((packed));
/* ------------------------------------------------------------------ */
/* Hash */
/* ------------------------------------------------------------------ */
uint32_t lvd_fnv1a(const char *docroot);
/* ------------------------------------------------------------------ */
/* Read-only (no locking, no .index access) */
/* ------------------------------------------------------------------ */
uint32_t lvd_map_lookup(uid_t uid, const char *docroot);
int lvd_map_verify_ownership(uid_t uid, uint32_t domain_id);
/* ------------------------------------------------------------------ */
/* Iteration (opendir/readdir style — zero-copy, mmap-backed) */
/* ------------------------------------------------------------------ */
typedef struct lvd_iter lvd_iter_t;
lvd_iter_t *lvd_map_iter_open(uid_t uid);
int lvd_map_iter_next(lvd_iter_t *it,
const char **docroot,
uint32_t *domain_id);
void lvd_map_iter_close(lvd_iter_t *it);
/* ------------------------------------------------------------------ */
/* Read-write (acquires flock on .index) */
/* ------------------------------------------------------------------ */
int lvd_map_assign(uid_t uid, const char *docroot, uint32_t *out_id);
int lvd_map_remove(uid_t uid, const char *docroot, uint32_t *old_id);
int lvd_map_remove_all(uid_t uid);
/* ------------------------------------------------------------------ */
/* Index management */
/* ------------------------------------------------------------------ */
int lvd_index_rebuild(void);
/* ------------------------------------------------------------------ */
/* Domain ID threshold */
/* ------------------------------------------------------------------ */
/*
* Minimum domain LVE ID — reads UID_MAX from /etc/login.defs at runtime.
* Returns max(UID_MAX, LVD_UID_MAX_DEFAULT) so domain IDs never go
* below the compile-time floor (60000).
*/
uint32_t lvd_get_id_min(void);
#endif /* _LVD_MAP_H_ */
PK !
A; lveinfo.ver.cagefs/lveinfo.vernu [ PK ! a=,2 ,2 R lve-ctl.hnu [ PK ! ړ
2 lve-type.hnu [ PK !
+l
< secureio.hnu [ PK ! |U F setcap.hnu [ PK ! ,2 H lvd-map.hnu [ PK Y