[Varnish] #111: mgt_vcc.c hard path for /tmp

[Varnish]

#111: mgt_vcc.c hard path for /tmp
-----------------------+----------------------------------------------------
 Reporter:  nwmcsween  |       Owner:  phk  
     Type:  defect     |      Status:  new  
 Priority:  normal     |   Milestone:       
Component:  varnishd   |     Version:  trunk
 Severity:  normal     |    Keywords:       
-----------------------+----------------------------------------------------
 mgt_vcc.c has a hard path for /tmp which is usually mounted noexec /
 nosuid on hardened servers leading to this:
 #Problem loading compiled VCL program:
         /tmp/vcl.XX8cn1K9: failed to map segment from shared object:
 Operation not permitted

 {{{
 static char *
 137     mgt_CallCc(const char *source, struct vsb *sb)
 138     {
 139             FILE *fo, *fs;
 140             char *of, *sf, buf[BUFSIZ];
 141             int i, j, sfd;
 142             void *p;
 143
 144             /* Create temporary C source file */
 145             sf = strdup("/tmp/vcl.XXXXXXXX");
 146             assert(sf != NULL);
 147             sfd = mkstemp(sf);
 148             if (sfd < 0) {
 149                     vsb_printf(sb,
 150                         "Cannot open temporary source file \"%s\":
 %s\n",
 151                         sf, strerror(errno));
 152                     free(sf);
 153                     return (NULL);
 154             }
 155             fs = fdopen(sfd, "r+");
 156             assert(fs != NULL);
 157
 158             if (fputs(source, fs) < 0 || fflush(fs)) {
 159                     vsb_printf(sb,
 160                         "Write error to C source file: %s\n",
 161                         strerror(errno));
 162                     unlink(sf);
 163                     fclose(fs);
 164                     return (NULL);
 165             }
 166             rewind(fs);
 167
 168             /* Name the output shared library */
 169             of = strdup("/tmp/vcl.XXXXXXXX");
 170             assert(of != NULL);
 171             of = mktemp(of);
 172             assert(of != NULL);
 173
 174             /* Attempt to open a pipe to the system C-compiler */
 175             sprintf(buf,
 176                 "ln -f %s /tmp/_.c ;"               /* XXX: for
 debugging */
 177                 "exec cc -fpic -shared -Wl,-x -o %s -x c - < %s 2>&1",
 178                 sf, of, sf);
 179
 180             fo = popen(buf, "r");
 181             if (fo == NULL) {
 182                     vsb_printf(sb,
 183                         "Internal error: Cannot execute cc(1): %s\n",
 184                         strerror(errno));
 185                     free(of);
 186                     unlink(sf);
 187                     fclose(fs);
 188                     return (NULL);
 189             }
 190
 191             /* If we get any output, it's bad */
 192             j = 0;
 193             while (1) {
 194                     if (fgets(buf, sizeof buf, fo) == NULL)
 195                             break;
 196                     if (!j) {
 197                             vsb_printf(sb, "Internal error: cc(1)
 complained:\n");
 198                             j++;
 199                     }
 200                     vsb_cat(sb, buf);
 201             }
 202
 203             i = pclose(fo);
 204             if (j == 0 && i != 0)
 205                     vsb_printf(sb,
 206                         "Internal error: cc(1) exit status 0x%04x\n",
 i);
 207
 208             /* If the compiler complained, or exited non-zero, fail */
 209             if (i || j) {
 210                     unlink(of);
 211                     free(of);
 212                     of = NULL;
 213             }
 214
 215             /* Next, try to load the object into the management
 process */
 216             p = dlopen(of, RTLD_NOW | RTLD_LOCAL);
 217             if (p == NULL) {
 218                     vsb_printf(sb, "Problem loading compiled VCL
 program:\n\t%s\n",
 219                         dlerror());
 220                     unlink(of);
 221                     free(of);
 222                     of = NULL;
 223             } else
 224                     AZ(dlclose(p));
 225
 226             /* clean up and return */
 227             unlink(sf);
 228             free(sf);
 229             fclose(fs);
 230             return (of);
 231     }
 }}}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/111>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator