op public repos

Commits

Commit:: 75c6959bf28d0e53adad5493df0fba6715e181fa
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Jul 3 06:59:33 2021 UTC

configure: add --disable-sandbox Calling `configure' with --disable-sandbox will disable the sandbox support *completely* at compile time. gmid will still complain at compile time and during the startup. Users shouldn't disable the sandbox if possible, but instead report problem upstream so they get fixed (hopefully.) #4 related

diff | patch | tree

Commit:: 6c0b8478504cb1d6eb029a095992de0d161e5933
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Jul 3 06:59:18 2021 UTC

reworked seccomp filter * SECCOMP_AUDIT_ARCH extended to support more architectures * relax fcntl policy: allow the syscall regardless of the flags * wrap every syscall in a ifdef, and add some (statx, fcntl64, ...) used in x86 Some bits were taken from dhcpcd[0], thanks! [0]: https://roy.marples.name/git/dhcpcd/blob/HEAD:/src/privsep-linux.c

diff | patch | tree

Commit:: d8f12360d43df7258b9dcd6cfd76a1d72a2b3798
From:: Omar Polo <op@omarpolo.com>
Date:: Mon Apr 12 20:25:05 2021 UTC

cherry-picking commit c928dcc7ba12c5040127e33485b246b13dd63ed9

diff | patch | tree

Commit:: 762d824cb126dc40df1dccc84b8c68ca1a821837
From:: Omar Polo <op@omarpolo.com>
Date:: Mon Apr 12 20:23:28 2021 UTC

fix IRI-parsing bug Some particularly crafted IRIs can cause a denial of service (DOS). IRIs which have a trailing `..' segment and resolve to a valid IRI (i.e. a .. that's not escaping the root directory) will make the server process loop forever. This is """just""" an DOS vulnerability, it doesn't expose anything sensitive or give an attacker anything else.

diff | patch | tree

Commit:: c8249bada3df6ab700dadaae36e9570cc8e62d55
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 12:04:23 2021 UTC

gmid v1.6 -- "Stargazers"

diff | patch | tree

Commit:: b890467e60fcd960c6b77ea8aa4290bd7b62b8e1
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 11:46:12 2021 UTC

typo

diff | patch | tree

Commit:: 94be0bf03bf16b3423eec28500495569f0821c01
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 11:08:17 2021 UTC

update README

diff | patch | tree

Commit:: 8e09ee1d50250261fa8e978b9fbcea46dd0b015f
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 10:48:11 2021 UTC

typo

diff | patch | tree

Commit:: b9c9123b8ecf2bd73498dc7cb0526be73df7ee9e
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 10:43:23 2021 UTC

fix signal handling so it works on linux too it seems that linux calls the signal handlers even when we're waiting on sigwait for that signal. Work around that.

diff | patch | tree

Commit:: e3d81f49cc4084f6af16a497cf56d15d79d1c1b8
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 09:24:44 2021 UTC

[seccomp] allow prlimit64 it's needed by getdtablesize, at least on glibc

diff | patch | tree

Commit:: d632468df510578999cf3e34f422728e879d7286
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 09:23:53 2021 UTC

fix correct shutdown after SIG{INT,TERM}

diff | patch | tree

Commit:: 7e3aaf3752a9df96bb830877c62fbd02988a769a
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 08:54:03 2021 UTC

sync changelog

diff | patch | tree

Commit:: 052c9d240345b1e5b9ef11dbc3b9cb28978cdb89
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 08:51:58 2021 UTC

kill only $pid during regress testing before we did `pkill gmid', but that would influence also other instances of gmid!

diff | patch | tree

Commit:: 1d3eb470b0e5961d74cf202567a0e4c0b57f7f12
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 08:51:17 2021 UTC

quit every process cleanly when receiving SIGINT or SIGTERM

diff | patch | tree

Commit:: 62e001b06778c96d0deebceddf1913f7b57ab2d6
From:: Omar Polo <op@omarpolo.com>
Date:: Sat Mar 20 08:42:08 2021 UTC

move all sandbox-related code to sandbox.c while there, add capsicum for the logger process

diff | patch | tree