src/sandbox/libsandbox.c - mirrors/cros/chromiumos/third_party/portage_tool - Git at Google

 /*
 **	Path sandbox for the gentoo linux portage package system, initially
 **	based on the ROCK Linux Wrapper for getting a list of created files
 **
 **  to integrate with bash, bash should have been built like this
 **
 **  ./configure --prefix=<prefix> --host=<host> --without-gnu-malloc
 **
 **  it's very important that the --enable-static-link option is NOT specified
 **
 **	Copyright (C) 2001 Geert Bevin, Uwyn, http://www.uwyn.com
 **	Distributed under the terms of the GNU General Public License, v2 or later
 **	Author : Geert Bevin <gbevin@uwyn.com>
 **  $Id: /var/cvsroot/gentoo-src/portage/src/sandbox/Attic/libsandbox.c,v 1.8 2002/08/05 05:51:39 drobbins Exp $
 */

 #define _GNU_SOURCE
 #define _REENTRANT

 #define open xxx_open
 #define open64 xxx_open64
 #  include <dirent.h>
 #  include <dlfcn.h>
 #  include <errno.h>
 #  include <fcntl.h>
 #  include <stdarg.h>
 #  include <stdio.h>
 #  include <stdlib.h>
 #  include <string.h>
 #  include <sys/file.h>
 #  include <sys/stat.h>
 #  include <sys/types.h>
 #  include <unistd.h>
 #  include <utime.h>
 #undef open
 #undef open64

 #define PIDS_FILE	"/tmp/sandboxpids.tmp"

 typedef struct {
 	int		show_access_violation;
 	char**	deny_prefixes;
 	int		num_deny_prefixes;
 	char**	read_prefixes;
 	int		num_read_prefixes;
 	char**	write_prefixes;
 	int		num_write_prefixes;
 	char**	predict_prefixes;
 	int		num_predict_prefixes;
 	char**	write_denied_prefixes;
 	int		num_write_denied_prefixes;
 } sbcontext_t;

 int 	check_access(sbcontext_t*, const char*, const char*);
 int 	check_syscall(sbcontext_t*, const char*, const char*);
 int 	before_syscall(const char*, const char*);
 int 	before_syscall_open_int(const char*, const char*, int);
 int 	before_syscall_open_char(const char*, const char*, const char*);
 void 	clean_env_entries(char***, int*);
 char*	filter_path(const char*);
 void*	get_dl_symbol(char*);
 void	init_context(sbcontext_t*);
 void 	init_env_entries(char***, int*, char*, int);
 int		is_sandbox_on();
 int		is_sandbox_pid();

 /* Wrapper macros and functions */

 /* macro definition to wrap functions before and after the
    execution of basic file related system-calls.

    nr   : the argument number of the system-call's argument that
           contains the file name to monitor
    rt   : the return type of the system call
    name : the name of the function call
    arg1, arg2, arg3 : the types of the function call's arguments
    fl   : the argument number of the system-call's argument that
           contains the file access flags
    md   : the argument number of the system-call's argument that
           contains the file access mode
 */
 #define wrsysc3(nr, rt, name, arg1, arg2, arg3)								\
 																			\
 /* the function call is defined externally from this file */				\
 extern rt name(arg1, arg2, arg3);											\
 																			\
 /* orig_ ## name is a pointer to a function with three arguments and the
    return type of the system call. This will be used to store the pointer
    to the system call function and call it. */								\
 rt (*orig_ ## name)(arg1, arg2, arg3) = NULL;								\
 																			\
 rt name(arg1 a1, arg2 a2, arg3 a3)											\
 {																			\
 	rt result = -1;															\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 1 == before_syscall(#name, a ## nr))		\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1, a2, a3);									\
 	}																		\
 	return result;															\
 }

 #define wrsysc2(nr, rt, name, arg1, arg2)									\
 extern rt name(arg1, arg2);													\
 rt (*orig_ ## name)(arg1, arg2) = NULL;										\
 																			\
 rt name(arg1 a1, arg2 a2)													\
 {																			\
 	rt result = -1;															\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 1 == before_syscall(#name, a ## nr))		\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1, a2);										\
 	}																		\
 	return result;															\
 }

 #define wrsysc1(nr, rt, name, arg1)											\
 extern rt name(arg1);														\
 rt (*orig_ ## name)(arg1) = NULL;											\
 																			\
 rt name(arg1 a1)															\
 {																			\
 	rt result = -1;															\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 1 == before_syscall(#name, a ## nr))		\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1);											\
 	}																		\
 	return result;															\
 }

 #define wrsysc1ptr(nr, rt, name, arg1)										\
 extern rt name(arg1);														\
 rt (*orig_ ## name)(arg1) = NULL;											\
 																			\
 rt name(arg1 a1)															\
 {																			\
 	rt result = NULL;														\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 1 == before_syscall(#name, a ## nr))		\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1);											\
 	}																		\
 	return result;															\
 }

 #define wropenint3(nr, fl, rt, name, arg1, arg2, arg3)						\
 extern rt name(arg1, arg2, arg3);											\
 rt (*orig_ ## name)(arg1, arg2, arg3) = NULL;								\
 																			\
 rt name(arg1 a1, arg2 a2, arg3 a3)											\
 {																			\
 	rt result = -1; 														\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 											\
 		1 == before_syscall_open_int(#name, a ## nr, a ## fl))				\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1, a2, a3);									\
 	}																		\
 	return result;															\
 }

 #define wropenchar2(nr, md, rt, name, arg1, arg2)							\
 extern rt name(arg1, arg2);													\
 rt (*orig_ ## name)(arg1, arg2) = NULL;										\
 																			\
 rt name(arg1 a1, arg2 a2)													\
 {																			\
 	rt result = NULL;														\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 											\
 		1 == before_syscall_open_char(#name, a ## nr, a ## md))				\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1, a2);										\
 	}																		\
 	return result;															\
 }

 #define wropenchar3(nr, md, rt, name, arg1, arg2, arg3)						\
 extern rt name(arg1, arg2, arg3);											\
 rt (*orig_ ## name)(arg1, arg2, arg3) = NULL;								\
 																			\
 rt name(arg1 a1, arg2 a2, arg3 a3)											\
 {																			\
 	rt result = NULL;														\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 											\
 		1 == before_syscall_open_char(#name, a ## nr, a ## md))				\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1, a2, a3);									\
 	}																		\
 	return result;															\
 }

 #define wrexec3(nr, rt, name, arg1, arg2, arg3)								\
 extern rt name(arg1, arg2, arg3);											\
 rt (*orig_ ## name)(arg1, arg2, arg3) = NULL;								\
 																			\
 rt name(arg1 a1, arg2 a2, arg3 a3)											\
 {																			\
 	rt result = -1;															\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 1 == before_syscall(#name, a ## nr))		\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1, a2, a3);									\
 	}																		\
 	return result;															\
 }

 #define wrexec2(nr, rt, name, arg1, arg2)									\
 extern rt name(arg1, arg2);													\
 rt (*orig_ ## name)(arg1, arg2) = NULL;										\
 																			\
 rt name(arg1 a1, arg2 a2)													\
 {																			\
 	rt result = -1;															\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 1 == before_syscall(#name, a ## nr))		\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = orig_ ## name(a1, a2);										\
 	}																		\
 	return result;															\
 }

 #define wrexec2va(nr, rt, name, arg1, arg2)									\
 extern rt name(arg1, arg2, ...);											\
 rt (*orig_ ## name)(arg1, arg2, ...) = NULL;								\
 																			\
 rt name(arg1 a1, arg2 a2, ...)												\
 {																			\
 	void* result = NULL; 													\
 	int old_errno = errno;													\
 	if (0 == is_sandbox_on() || 1 == before_syscall(#name, a ## nr))		\
 	{																		\
 		if (!orig_ ## name)													\
 		{																	\
 			orig_ ## name = get_dl_symbol(#name);							\
 		}																	\
 		errno = old_errno;													\
 		result = __builtin_apply( (void(*)()) orig_ ## name, 				\
 									__builtin_apply_args(), 32 );			\
 		old_errno = errno;													\
 	}																		\
 	if (NULL == result)														\
 	{																		\
 		return -1;															\
 	}																		\
 	else																	\
 	{																		\
 		__builtin_return(result);											\
 	}																		\
 }

 wropenint3(1, 2, int, open,   const char*, int, mode_t)
 wropenint3(1, 2, int, open64, const char*, int, mode_t)

 wropenchar2(1, 2, FILE*, fopen,   const char*, const char*)
 wropenchar2(1, 2, FILE*, fopen64, const char*, const char*)
 wropenchar3(1, 2, FILE*, freopen, const char*, const char*, FILE*)

 wropenchar2(1, 2, FILE*, popen,   const char*, const char*)

 // write syscalls

 wrsysc2(1, int, creat,   const char*, mode_t)
 wrsysc2(1, int, creat64, const char*, mode_t)

 wrsysc2(1, int, mkdir,  const char*, mode_t)
 wrsysc3(1, int, mknod,  const char*, mode_t, dev_t)
 wrsysc2(1, int, mkfifo, const char*, mode_t)

 wrsysc2(2, int, link,    const char*, const char*)
 wrsysc2(2, int, symlink, const char*, const char*)
 wrsysc2(2, int, rename,  const char*, const char*)

 wrsysc2(1, int, utime,  const char*, const struct utimbuf*)
 wrsysc2(1, int, utimes, const char*, struct timeval*)

 wrsysc1(1, int, unlink, const char*)
 wrsysc1(1, int, rmdir,  const char*)

 wrsysc3(1, int, chown,  const char*, uid_t, gid_t)
 wrsysc3(1, int, lchown, const char*, uid_t, gid_t)

 wrsysc2(1, int, chmod, const char*, mode_t)

 /* read syscalls */

 wrsysc1ptr(1, DIR*, opendir, const char*)

 /* execution syscalls */
 wrsysc1(1, int, system, const char*)

 wrexec2va(1, int, execl,  const char*, const char*)
 wrexec2va(1, int, execle, const char*, const char*)
 wrexec2(1, int, execv,    const char*, char* const*)
 wrexec3(1, int, execve,   const char*, char* const*, char* const*)
 /* execlp is redirected to execvp */
 /* execvp is special since it should search the PATH var entries */
 extern int execvp(const char*, char* const*);
 int(*orig_execvp)(const char*, char* const*) = NULL;
 int execvp(const char* file, char* const* argv)
 {
 	int		result = -1;
 	int		old_errno = errno;
 	int		i = 0;
 	int		allowed = 1;
 	char**	path_entries = NULL;
 	int		num_path_entries = 0;
 	char	constructed_path[255];

 	if (1 == is_sandbox_on())
 	{
 		init_env_entries(&path_entries, &num_path_entries, "PATH", 0);
 		for (i = 0; i < num_path_entries; i++)
 		{
 			strcpy(constructed_path, path_entries[i]);
 			strcat(constructed_path, "/");
 			strcat(constructed_path, file);
 			if (0 == before_syscall("execvp", constructed_path))
 			{
 				allowed = 0;
 				break;
 			}
 		}
 		clean_env_entries(&path_entries, &num_path_entries);
 	}

 	if (1 == allowed)
 	{
 		if (!orig_execvp)
 		{
 			orig_execvp = get_dl_symbol("execvp");
 		}
 		errno = old_errno;
 		result = orig_execvp(file, argv);
 		old_errno = errno;
 	}
 	errno = old_errno;
 	return result;
 }

 /* lseek, lseek64, fdopen, fchown, fchmod, fcntl, lockf
    are not wrapped since they can't be used if open is wrapped correctly
    and unaccessible file descriptors are not possible to create */

 void* get_dl_symbol(char* symname)
 {
 	void* result = dlsym(RTLD_NEXT, symname);
 	if (0 == result)
 	{
 		fprintf(stderr, "Sandbox : can't resolve %s: %s.\n", symname, dlerror());
 		abort();
 	}
 	return result;
 }

 void init_context(sbcontext_t* context)
 {
 	context->show_access_violation = 1;
 	context->deny_prefixes = NULL;
 	context->num_deny_prefixes = 0;
 	context->read_prefixes = NULL;
 	context->num_read_prefixes = 0;
 	context->write_prefixes = NULL;
 	context->num_write_prefixes = 0;
 	context->predict_prefixes = NULL;
 	context->num_predict_prefixes = 0;
 	context->write_denied_prefixes = NULL;
 	context->num_write_denied_prefixes = 0;
 }

 int is_sandbox_pid()
 {
 	int		result = 0;
 	FILE*	pids_stream = NULL;
 	int		pids_file = -1;
 	int		current_pid = 0;
 	int		tmp_pid = 0;

 	pids_stream = fopen(PIDS_FILE, "r");
 	if (NULL == pids_stream)
 	{
 		perror(">>> pids file fopen");
 	}
 	else
 	{
 		pids_file = fileno(pids_stream);
 		if (pids_file < 0)
 		{
 			perror(">>> pids file fileno");
 		}
 		else
 		{
 			current_pid = getpid();

 			while (EOF != fscanf(pids_stream, "%d\n", &tmp_pid))
 			{
 				if (tmp_pid == current_pid)
 				{
 					result = 1;
 					break;
 				}
 			}
 		}
 		if (EOF == fclose(pids_stream))
 		{
 			perror(">>> pids file fclose");
 		}
 		pids_stream = NULL;
 		pids_file = -1;
 	}

 	return result;
 }

 void clean_env_entries(char*** prefixes_array, int* prefixes_num)
 {
 	int i = 0;
 	if (NULL != *prefixes_array)
 	{
 		for (i = 0; i < *prefixes_num; i++)
 		{
 			if (NULL != (*prefixes_array)[i])
 			{
 				free((*prefixes_array)[i]);
 				(*prefixes_array)[i] = NULL;
 			}
 		}
 		free(*prefixes_array);
 		*prefixes_array = NULL;

 		*prefixes_num = 0;
 	}
 }

 void init_env_entries(char*** prefixes_array, int* prefixes_num, char* env, int warn)
 {
 	char* prefixes_env = getenv(env);

 	if (NULL == prefixes_env)
 	{
 		fprintf(stderr, "Sandbox error : the %s environmental variable should be defined.\n", env);
 	}
 	else
 	{
 		char*	buffer = NULL;
 		int		prefixes_env_length = strlen(prefixes_env);
 		int		i = 0;
 		int		num_delimiters = 0;
 		char*	token = NULL;
 		char*	prefix = NULL;

 		for (i = 0; i < prefixes_env_length; i++)
 		{
 			if (':' == prefixes_env[i])
 			{
 				num_delimiters++;
 			}
 		}

 		if (num_delimiters > 0)
 		{
 			buffer = (char*)malloc(sizeof(char)*(prefixes_env_length+1));
 			*prefixes_array = (char**)malloc(sizeof(char*)*(num_delimiters+1));

 			strcpy(buffer, prefixes_env);
 			token = strtok(buffer, ":");
 			while (NULL != token &&
 				   strlen(token) > 0)
 			{
 				prefix = (char*)malloc(sizeof(char)*(strlen(token)+1));
 				strcpy(prefix, token);
 				(*prefixes_array)[(*prefixes_num)++] = filter_path(prefix);
 				free(prefix);
 				token = strtok(NULL, ":");
 			}
 			free(buffer);
 			buffer = NULL;
 		}
 		else if(prefixes_env_length > 0)
 		{
 			(*prefixes_array) = (char**)malloc(sizeof(char*));

 			prefix = (char*)malloc(sizeof(char)*(prefixes_env_length+1));
 			strcpy(prefix, prefixes_env);
 			(*prefixes_array)[(*prefixes_num)++] = filter_path(prefix);
 			free(prefix);
 		}
 	}
 }

 char* filter_path(const char* path)
 {
 	int		initial_path_length = strlen(path);
 	char*	filtered_path = (char*)malloc(sizeof(char)*(initial_path_length+1));
 	int		i = 0;
 	int		j = 0;

 	for (i = 0, j = 0; i < initial_path_length;)
 	{
 		filtered_path[j] = path[i];
 		if ('/' == filtered_path[j])
 		{
 			while ('/' == path[i] &&
 				   i < initial_path_length)
 			{
 				i++;
 			}
 		}
 		else
 		{
 			i++;
 		}
 		j++;
 	}
 	filtered_path[j] = 0;

 	return filtered_path;
 }

 int check_access(sbcontext_t* sbcontext, const char* func, const char* path)
 {
 	int		result = -1;
 	int		i = 0;
 	char*	filtered_path = filter_path(path);

 	if ('/' != path[0])
 	{
 		return 0;
 	}

 	if (0 == strcmp(filtered_path, "/etc/ld.so.preload") &&
 		is_sandbox_pid())
 	{
 		result = 1;
 	}

 	if (-1 == result)
 	{
 		if (NULL != sbcontext->deny_prefixes)
 		{
 			for (i = 0; i < sbcontext->num_deny_prefixes; i++)
 			{
 				if (0 == strncmp(filtered_path, sbcontext->deny_prefixes[i], strlen(sbcontext->deny_prefixes[i])))
 				{
 					result = 0;
 					break;
 				}
 			}
 		}

 		if (-1 == result)
 		{
 			if (NULL != sbcontext->read_prefixes &&
 				(0 == strcmp(func, "open_rd") ||
 				 0 == strcmp(func, "popen") ||
 				 0 == strcmp(func, "opendir") ||
 				 0 == strcmp(func, "system") ||
 				 0 == strcmp(func, "execl") ||
 				 0 == strcmp(func, "execlp") ||
 				 0 == strcmp(func, "execle") ||
 				 0 == strcmp(func, "execv") ||
 				 0 == strcmp(func, "execvp") ||
 				 0 == strcmp(func, "execve")))
 			{
 				for (i = 0; i < sbcontext->num_read_prefixes; i++)
 				{
 					if (0 == strncmp(filtered_path, sbcontext->read_prefixes[i], strlen(sbcontext->read_prefixes[i])))
 					{
 						result = 1;
 						break;
 					}
 				}
 			}
 			else if (NULL != sbcontext->write_prefixes &&
 					 (0 == strcmp(func, "open_wr") ||
 					  0 == strcmp(func, "creat") ||
 					  0 == strcmp(func, "creat64") ||
 					  0 == strcmp(func, "mkdir") ||
 					  0 == strcmp(func, "mknod") ||
 					  0 == strcmp(func, "mkfifo") ||
 					  0 == strcmp(func, "link") ||
 					  0 == strcmp(func, "symlink") ||
 					  0 == strcmp(func, "rename") ||
 					  0 == strcmp(func, "utime") ||
 					  0 == strcmp(func, "utimes") ||
 					  0 == strcmp(func, "unlink") ||
 					  0 == strcmp(func, "rmdir") ||
 					  0 == strcmp(func, "chown") ||
 					  0 == strcmp(func, "lchown") ||
 					  0 == strcmp(func, "chmod")))
 			{
 				struct stat	tmp_stat;

 				for (i = 0; i < sbcontext->num_write_denied_prefixes; i++)
 				{
 					if (0 == strncmp(filtered_path, sbcontext->write_denied_prefixes[i], strlen(sbcontext->write_denied_prefixes[i])))
 					{
 						result = 0;
 						break;
 					}
 				}
 				if (-1 == result)
 				{
 					for (i = 0; i < sbcontext->num_write_prefixes; i++)
 					{
 						if (0 == strncmp(filtered_path, sbcontext->write_prefixes[i], strlen(sbcontext->write_prefixes[i])))
 						{
 							result = 1;
 							break;
 						}
 					}

 					if (-1 == result)
 					{
 						/* hack to prevent mkdir of existing dirs to show errors */
 						if (strcmp(func, "mkdir") == 0)
 						{
 							if (0 == stat(filtered_path, &tmp_stat))
 							{
 								sbcontext->show_access_violation = 0;
 								result = 0;
 							}
 						}

 						if (-1 == result)
 						{
 							for (i = 0; i < sbcontext->num_predict_prefixes; i++)
 							{
 								if (0 == strncmp(filtered_path, sbcontext->predict_prefixes[i], strlen(sbcontext->predict_prefixes[i])))
 								{
 									sbcontext->show_access_violation = 0;
 									result = 0;
 									break;
 								}
 							}
 						}
 					}
 				}
 			}
 		}
 	}

 	if (-1 == result)
 	{
 		result = 0;
 	}

 	free(filtered_path);

 	return result;
 }

 int check_syscall(sbcontext_t* sbcontext, const char* func, const char* file)
 {
 	int			result = 1;
 	char*		absolute_path = NULL;
 	char*		tmp_buffer = NULL;
 	struct stat	log_stat;
 	char*		log_path = NULL;
 	int 		log_file = 0;
 	struct stat	debug_log_stat;
 	char*		debug_log_env = NULL;
 	char*		debug_log_path = NULL;
 	int 		debug_log_file = 0;
 	char 		buffer[512];

 	if ('/' == file[0])
 	{
 		absolute_path = (char*)malloc(sizeof(char)*(strlen(file)+1));
 		sprintf(absolute_path, "%s", file);
 	}
 	else
 	{
 		tmp_buffer = get_current_dir_name();
 		absolute_path = (char*)malloc(sizeof(char)*(strlen(tmp_buffer)+1+strlen(file)+1));
 		sprintf(absolute_path,"%s/%s", tmp_buffer, file);
 		free(tmp_buffer);
 		tmp_buffer = NULL;
 	}

 	log_path = getenv("SANDBOX_LOG");
 	debug_log_env = getenv("SANDBOX_DEBUG");
 	debug_log_path = getenv("SANDBOX_DEBUG_LOG");

 	if ((NULL == log_path || 0 != strcmp(absolute_path, log_path)) &&
 		(NULL == debug_log_env || NULL == debug_log_path || 0 != strcmp(absolute_path, debug_log_path)) &&
 		0 == check_access(sbcontext, func, absolute_path))
 	{
 		if (1 == sbcontext->show_access_violation)
 		{
 			fprintf(stderr, "\e[31;01mACCESS DENIED\033[0m  %s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);

 			if (NULL != log_path)
 			{
 				sprintf(buffer, "%s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);
 				if (0 == lstat(log_path, &log_stat) &&
 					0 == S_ISREG(log_stat.st_mode))
 				{
 					fprintf(stderr, "\e[31;01mSECURITY BREACH\033[0m  %s already exists and is not a regular file.\n", log_path);
 				}
 				else
 				{
 					log_file = open(log_path, O_APPEND|O_WRONLY|O_CREAT, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
 					if(log_file >= 0)
 					{
 						write(log_file, buffer, strlen(buffer));
 						close(log_file);
 					}
 				}
 			}
 		}

 		result = 0;
 	}
 	else if (NULL != debug_log_env)
 	{
 		if (NULL != debug_log_path)
 		{
 			if (0 != strcmp(absolute_path, debug_log_path))
 			{
 				sprintf(buffer, "%s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);
 				if (0 == lstat(debug_log_path, &debug_log_stat) &&
 					0 == S_ISREG(debug_log_stat.st_mode))
 				{
 					fprintf(stderr, "\e[31;01mSECURITY BREACH\033[0m  %s already exists and is not a regular file.\n", log_path);
 				}
 				else
 				{
 					debug_log_file = open(debug_log_path, O_APPEND|O_WRONLY|O_CREAT, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
 					if(debug_log_file >= 0)
 					{
 						write(debug_log_file, buffer, strlen(buffer));
 						close(debug_log_file);
 					}
 				}
 			}
 		}
 		else
 		{
 			fprintf(stderr, "\e[32;01mACCESS ALLOWED\033[0m %s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);
 		}
 	}

 	free(absolute_path);
 	absolute_path = NULL;

 	return result;
 }

 int is_sandbox_on()
 {
 	/* $SANDBOX_ACTIVE is an env variable that should ONLY
 	 * be used internal by sandbox.c and libsanbox.c.  External
 	 * sources should NEVER set it, else the sandbox is enabled
 	 * in some cases when run in parallel with another sandbox,
 	 * but not even in the sandbox shell.
 	 *
 	 * Azarah (3 Aug 2002)
 	 */
 	if (NULL != getenv("SANDBOX_ON") &&
 		0 == strcmp(getenv("SANDBOX_ON"), "1") &&
 		NULL != getenv("SANDBOX_ACTIVE") &&
 		0 == strcmp(getenv("SANDBOX_ACTIVE"), "armedandready"))
 	{
 		return 1;
 	}
 	else
 	{
 		return 0;
 	}
 }

 int before_syscall(const char* func, const char* file)
 {
 	int 		result = 1;

 	sbcontext_t	sbcontext;

 	init_context(&sbcontext);

 	init_env_entries(&(sbcontext.deny_prefixes), &(sbcontext.num_deny_prefixes), "SANDBOX_DENY", 1);
 	init_env_entries(&(sbcontext.read_prefixes), &(sbcontext.num_read_prefixes), "SANDBOX_READ", 1);
 	init_env_entries(&(sbcontext.write_prefixes), &(sbcontext.num_write_prefixes), "SANDBOX_WRITE", 1);
 	init_env_entries(&(sbcontext.predict_prefixes), &(sbcontext.num_predict_prefixes), "SANDBOX_PREDICT", 1);

 	result = check_syscall(&sbcontext, func, file);

 	clean_env_entries(&(sbcontext.deny_prefixes), &(sbcontext.num_deny_prefixes));
 	clean_env_entries(&(sbcontext.read_prefixes), &(sbcontext.num_read_prefixes));
 	clean_env_entries(&(sbcontext.write_prefixes), &(sbcontext.num_write_prefixes));
 	clean_env_entries(&(sbcontext.predict_prefixes), &(sbcontext.num_predict_prefixes));

 	if (0 == result)
 	{
 		errno = EACCES;
 	}

 	return result;
 }

 int before_syscall_open_int(const char* func, const char* file, int flags)
 {
 	if (flags & O_WRONLY ||
 		flags & O_RDWR)
 	{
 		return before_syscall("open_wr", file);
 	}
 	else
 	{
 		return before_syscall("open_rd", file);
 	}
 }

 int before_syscall_open_char(const char* func, const char* file, const char* mode)
 {
 	if (strcmp(mode, "r") == 0 ||
 		strcmp(mode, "rb") == 0)
 	{
 		return before_syscall("open_rd", file);
 	}
 	else
 	{
 		return before_syscall("open_wr", file);
 	}
 }
	/*
	** Path sandbox for the gentoo linux portage package system, initially
	** based on the ROCK Linux Wrapper for getting a list of created files
	**
	** to integrate with bash, bash should have been built like this
	**
	** ./configure --prefix=<prefix> --host=<host> --without-gnu-malloc
	**
	** it's very important that the --enable-static-link option is NOT specified
	**
	** Copyright (C) 2001 Geert Bevin, Uwyn, http://www.uwyn.com
	** Distributed under the terms of the GNU General Public License, v2 or later
	** Author : Geert Bevin <gbevin@uwyn.com>
	** $Id: /var/cvsroot/gentoo-src/portage/src/sandbox/Attic/libsandbox.c,v 1.8 2002/08/05 05:51:39 drobbins Exp $
	*/

	#define _GNU_SOURCE
	#define _REENTRANT

	#define open xxx_open
	#define open64 xxx_open64
	# include <dirent.h>
	# include <dlfcn.h>
	# include <errno.h>
	# include <fcntl.h>
	# include <stdarg.h>
	# include <stdio.h>
	# include <stdlib.h>
	# include <string.h>
	# include <sys/file.h>
	# include <sys/stat.h>
	# include <sys/types.h>
	# include <unistd.h>
	# include <utime.h>
	#undef open
	#undef open64

	#define PIDS_FILE "/tmp/sandboxpids.tmp"

	typedef struct {
	int show_access_violation;
	char** deny_prefixes;
	int num_deny_prefixes;
	char** read_prefixes;
	int num_read_prefixes;
	char** write_prefixes;
	int num_write_prefixes;
	char** predict_prefixes;
	int num_predict_prefixes;
	char** write_denied_prefixes;
	int num_write_denied_prefixes;
	} sbcontext_t;

	int check_access(sbcontext_t, const char, const char*);
	int check_syscall(sbcontext_t, const char, const char*);
	int before_syscall(const char, const char);
	int before_syscall_open_int(const char, const char, int);
	int before_syscall_open_char(const char, const char, const char*);
	void clean_env_entries(char**, int);
	char* filter_path(const char*);
	void* get_dl_symbol(char*);
	void init_context(sbcontext_t*);
	void init_env_entries(char**, int, char*, int);
	int is_sandbox_on();
	int is_sandbox_pid();

	/* Wrapper macros and functions */

	/* macro definition to wrap functions before and after the
	execution of basic file related system-calls.

	nr : the argument number of the system-call's argument that
	contains the file name to monitor
	rt : the return type of the system call
	name : the name of the function call
	arg1, arg2, arg3 : the types of the function call's arguments
	fl : the argument number of the system-call's argument that
	contains the file access flags
	md : the argument number of the system-call's argument that
	contains the file access mode
	*/
	#define wrsysc3(nr, rt, name, arg1, arg2, arg3) \
	\
	/* the function call is defined externally from this file */ \
	extern rt name(arg1, arg2, arg3); \
	\
	/* orig_ ## name is a pointer to a function with three arguments and the
	return type of the system call. This will be used to store the pointer
	to the system call function and call it. */ \
	rt (*orig_ ## name)(arg1, arg2, arg3) = NULL; \
	\
	rt name(arg1 a1, arg2 a2, arg3 a3) \
	{ \
	rt result = -1; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| 1 == before_syscall(#name, a ## nr)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1, a2, a3); \
	} \
	return result; \
	}

	#define wrsysc2(nr, rt, name, arg1, arg2) \
	extern rt name(arg1, arg2); \
	rt (*orig_ ## name)(arg1, arg2) = NULL; \
	\
	rt name(arg1 a1, arg2 a2) \
	{ \
	rt result = -1; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| 1 == before_syscall(#name, a ## nr)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1, a2); \
	} \
	return result; \
	}

	#define wrsysc1(nr, rt, name, arg1) \
	extern rt name(arg1); \
	rt (*orig_ ## name)(arg1) = NULL; \
	\
	rt name(arg1 a1) \
	{ \
	rt result = -1; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| 1 == before_syscall(#name, a ## nr)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1); \
	} \
	return result; \
	}

	#define wrsysc1ptr(nr, rt, name, arg1) \
	extern rt name(arg1); \
	rt (*orig_ ## name)(arg1) = NULL; \
	\
	rt name(arg1 a1) \
	{ \
	rt result = NULL; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| 1 == before_syscall(#name, a ## nr)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1); \
	} \
	return result; \
	}

	#define wropenint3(nr, fl, rt, name, arg1, arg2, arg3) \
	extern rt name(arg1, arg2, arg3); \
	rt (*orig_ ## name)(arg1, arg2, arg3) = NULL; \
	\
	rt name(arg1 a1, arg2 a2, arg3 a3) \
	{ \
	rt result = -1; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| \
	1 == before_syscall_open_int(#name, a ## nr, a ## fl)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1, a2, a3); \
	} \
	return result; \
	}

	#define wropenchar2(nr, md, rt, name, arg1, arg2) \
	extern rt name(arg1, arg2); \
	rt (*orig_ ## name)(arg1, arg2) = NULL; \
	\
	rt name(arg1 a1, arg2 a2) \
	{ \
	rt result = NULL; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| \
	1 == before_syscall_open_char(#name, a ## nr, a ## md)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1, a2); \
	} \
	return result; \
	}

	#define wropenchar3(nr, md, rt, name, arg1, arg2, arg3) \
	extern rt name(arg1, arg2, arg3); \
	rt (*orig_ ## name)(arg1, arg2, arg3) = NULL; \
	\
	rt name(arg1 a1, arg2 a2, arg3 a3) \
	{ \
	rt result = NULL; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| \
	1 == before_syscall_open_char(#name, a ## nr, a ## md)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1, a2, a3); \
	} \
	return result; \
	}

	#define wrexec3(nr, rt, name, arg1, arg2, arg3) \
	extern rt name(arg1, arg2, arg3); \
	rt (*orig_ ## name)(arg1, arg2, arg3) = NULL; \
	\
	rt name(arg1 a1, arg2 a2, arg3 a3) \
	{ \
	rt result = -1; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| 1 == before_syscall(#name, a ## nr)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1, a2, a3); \
	} \
	return result; \
	}

	#define wrexec2(nr, rt, name, arg1, arg2) \
	extern rt name(arg1, arg2); \
	rt (*orig_ ## name)(arg1, arg2) = NULL; \
	\
	rt name(arg1 a1, arg2 a2) \
	{ \
	rt result = -1; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| 1 == before_syscall(#name, a ## nr)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = orig_ ## name(a1, a2); \
	} \
	return result; \
	}

	#define wrexec2va(nr, rt, name, arg1, arg2) \
	extern rt name(arg1, arg2, ...); \
	rt (*orig_ ## name)(arg1, arg2, ...) = NULL; \
	\
	rt name(arg1 a1, arg2 a2, ...) \
	{ \
	void* result = NULL; \
	int old_errno = errno; \
	if (0 == is_sandbox_on() \|\| 1 == before_syscall(#name, a ## nr)) \
	{ \
	if (!orig_ ## name) \
	{ \
	orig_ ## name = get_dl_symbol(#name); \
	} \
	errno = old_errno; \
	result = __builtin_apply( (void(*)()) orig_ ## name, \
	__builtin_apply_args(), 32 ); \
	old_errno = errno; \
	} \
	if (NULL == result) \
	{ \
	return -1; \
	} \
	else \
	{ \
	__builtin_return(result); \
	} \
	}

	wropenint3(1, 2, int, open, const char*, int, mode_t)
	wropenint3(1, 2, int, open64, const char*, int, mode_t)

	wropenchar2(1, 2, FILE, fopen, const char, const char*)
	wropenchar2(1, 2, FILE, fopen64, const char, const char*)
	wropenchar3(1, 2, FILE, freopen, const char, const char, FILE)

	wropenchar2(1, 2, FILE, popen, const char, const char*)

	// write syscalls

	wrsysc2(1, int, creat, const char*, mode_t)
	wrsysc2(1, int, creat64, const char*, mode_t)

	wrsysc2(1, int, mkdir, const char*, mode_t)
	wrsysc3(1, int, mknod, const char*, mode_t, dev_t)
	wrsysc2(1, int, mkfifo, const char*, mode_t)

	wrsysc2(2, int, link, const char, const char)
	wrsysc2(2, int, symlink, const char, const char)
	wrsysc2(2, int, rename, const char, const char)

	wrsysc2(1, int, utime, const char, const struct utimbuf)
	wrsysc2(1, int, utimes, const char, struct timeval)

	wrsysc1(1, int, unlink, const char*)
	wrsysc1(1, int, rmdir, const char*)

	wrsysc3(1, int, chown, const char*, uid_t, gid_t)
	wrsysc3(1, int, lchown, const char*, uid_t, gid_t)

	wrsysc2(1, int, chmod, const char*, mode_t)

	/* read syscalls */

	wrsysc1ptr(1, DIR, opendir, const char)

	/* execution syscalls */
	wrsysc1(1, int, system, const char*)

	wrexec2va(1, int, execl, const char, const char)
	wrexec2va(1, int, execle, const char, const char)
	wrexec2(1, int, execv, const char, char const*)
	wrexec3(1, int, execve, const char, char const, char const*)
	/* execlp is redirected to execvp */
	/* execvp is special since it should search the PATH var entries */
	extern int execvp(const char, char const*);
	int(orig_execvp)(const char, char* const*) = NULL;
	int execvp(const char* file, char* const* argv)
	{
	int result = -1;
	int old_errno = errno;
	int i = 0;
	int allowed = 1;
	char** path_entries = NULL;
	int num_path_entries = 0;
	char constructed_path[255];

	if (1 == is_sandbox_on())
	{
	init_env_entries(&path_entries, &num_path_entries, "PATH", 0);
	for (i = 0; i < num_path_entries; i++)
	{
	strcpy(constructed_path, path_entries[i]);
	strcat(constructed_path, "/");
	strcat(constructed_path, file);
	if (0 == before_syscall("execvp", constructed_path))
	{
	allowed = 0;
	break;
	}
	}
	clean_env_entries(&path_entries, &num_path_entries);
	}

	if (1 == allowed)
	{
	if (!orig_execvp)
	{
	orig_execvp = get_dl_symbol("execvp");
	}
	errno = old_errno;
	result = orig_execvp(file, argv);
	old_errno = errno;
	}
	errno = old_errno;
	return result;
	}

	/* lseek, lseek64, fdopen, fchown, fchmod, fcntl, lockf
	are not wrapped since they can't be used if open is wrapped correctly
	and unaccessible file descriptors are not possible to create */

	void* get_dl_symbol(char* symname)
	{
	void* result = dlsym(RTLD_NEXT, symname);
	if (0 == result)
	{
	fprintf(stderr, "Sandbox : can't resolve %s: %s.\n", symname, dlerror());
	abort();
	}
	return result;
	}

	void init_context(sbcontext_t* context)
	{
	context->show_access_violation = 1;
	context->deny_prefixes = NULL;
	context->num_deny_prefixes = 0;
	context->read_prefixes = NULL;
	context->num_read_prefixes = 0;
	context->write_prefixes = NULL;
	context->num_write_prefixes = 0;
	context->predict_prefixes = NULL;
	context->num_predict_prefixes = 0;
	context->write_denied_prefixes = NULL;
	context->num_write_denied_prefixes = 0;
	}

	int is_sandbox_pid()
	{
	int result = 0;
	FILE* pids_stream = NULL;
	int pids_file = -1;
	int current_pid = 0;
	int tmp_pid = 0;

	pids_stream = fopen(PIDS_FILE, "r");
	if (NULL == pids_stream)
	{
	perror(">>> pids file fopen");
	}
	else
	{
	pids_file = fileno(pids_stream);
	if (pids_file < 0)
	{
	perror(">>> pids file fileno");
	}
	else
	{
	current_pid = getpid();

	while (EOF != fscanf(pids_stream, "%d\n", &tmp_pid))
	{
	if (tmp_pid == current_pid)
	{
	result = 1;
	break;
	}
	}
	}
	if (EOF == fclose(pids_stream))
	{
	perror(">>> pids file fclose");
	}
	pids_stream = NULL;
	pids_file = -1;
	}

	return result;
	}

	void clean_env_entries(char*** prefixes_array, int* prefixes_num)
	{
	int i = 0;
	if (NULL != *prefixes_array)
	{
	for (i = 0; i < *prefixes_num; i++)
	{
	if (NULL != (*prefixes_array)[i])
	{
	free((*prefixes_array)[i]);
	(*prefixes_array)[i] = NULL;
	}
	}
	free(*prefixes_array);
	*prefixes_array = NULL;

	*prefixes_num = 0;
	}
	}

	void init_env_entries(char*** prefixes_array, int* prefixes_num, char* env, int warn)
	{
	char* prefixes_env = getenv(env);

	if (NULL == prefixes_env)
	{
	fprintf(stderr, "Sandbox error : the %s environmental variable should be defined.\n", env);
	}
	else
	{
	char* buffer = NULL;
	int prefixes_env_length = strlen(prefixes_env);
	int i = 0;
	int num_delimiters = 0;
	char* token = NULL;
	char* prefix = NULL;

	for (i = 0; i < prefixes_env_length; i++)
	{
	if (':' == prefixes_env[i])
	{
	num_delimiters++;
	}
	}

	if (num_delimiters > 0)
	{
	buffer = (char)malloc(sizeof(char)(prefixes_env_length+1));
	prefixes_array = (char)malloc(sizeof(char)*(num_delimiters+1));

	strcpy(buffer, prefixes_env);
	token = strtok(buffer, ":");
	while (NULL != token &&
	strlen(token) > 0)
	{
	prefix = (char)malloc(sizeof(char)(strlen(token)+1));
	strcpy(prefix, token);
	(prefixes_array)[(prefixes_num)++] = filter_path(prefix);
	free(prefix);
	token = strtok(NULL, ":");
	}
	free(buffer);
	buffer = NULL;
	}
	else if(prefixes_env_length > 0)
	{
	(prefixes_array) = (char)malloc(sizeof(char));

	prefix = (char)malloc(sizeof(char)(prefixes_env_length+1));
	strcpy(prefix, prefixes_env);
	(prefixes_array)[(prefixes_num)++] = filter_path(prefix);
	free(prefix);
	}
	}
	}

	char* filter_path(const char* path)
	{
	int initial_path_length = strlen(path);
	char* filtered_path = (char)malloc(sizeof(char)(initial_path_length+1));
	int i = 0;
	int j = 0;

	for (i = 0, j = 0; i < initial_path_length;)
	{
	filtered_path[j] = path[i];
	if ('/' == filtered_path[j])
	{
	while ('/' == path[i] &&
	i < initial_path_length)
	{
	i++;
	}
	}
	else
	{
	i++;
	}
	j++;
	}
	filtered_path[j] = 0;

	return filtered_path;
	}

	int check_access(sbcontext_t* sbcontext, const char* func, const char* path)
	{
	int result = -1;
	int i = 0;
	char* filtered_path = filter_path(path);

	if ('/' != path[0])
	{
	return 0;
	}

	if (0 == strcmp(filtered_path, "/etc/ld.so.preload") &&
	is_sandbox_pid())
	{
	result = 1;
	}

	if (-1 == result)
	{
	if (NULL != sbcontext->deny_prefixes)
	{
	for (i = 0; i < sbcontext->num_deny_prefixes; i++)
	{
	if (0 == strncmp(filtered_path, sbcontext->deny_prefixes[i], strlen(sbcontext->deny_prefixes[i])))
	{
	result = 0;
	break;
	}
	}
	}

	if (-1 == result)
	{
	if (NULL != sbcontext->read_prefixes &&
	(0 == strcmp(func, "open_rd") \|\|
	0 == strcmp(func, "popen") \|\|
	0 == strcmp(func, "opendir") \|\|
	0 == strcmp(func, "system") \|\|
	0 == strcmp(func, "execl") \|\|
	0 == strcmp(func, "execlp") \|\|
	0 == strcmp(func, "execle") \|\|
	0 == strcmp(func, "execv") \|\|
	0 == strcmp(func, "execvp") \|\|
	0 == strcmp(func, "execve")))
	{
	for (i = 0; i < sbcontext->num_read_prefixes; i++)
	{
	if (0 == strncmp(filtered_path, sbcontext->read_prefixes[i], strlen(sbcontext->read_prefixes[i])))
	{
	result = 1;
	break;
	}
	}
	}
	else if (NULL != sbcontext->write_prefixes &&
	(0 == strcmp(func, "open_wr") \|\|
	0 == strcmp(func, "creat") \|\|
	0 == strcmp(func, "creat64") \|\|
	0 == strcmp(func, "mkdir") \|\|
	0 == strcmp(func, "mknod") \|\|
	0 == strcmp(func, "mkfifo") \|\|
	0 == strcmp(func, "link") \|\|
	0 == strcmp(func, "symlink") \|\|
	0 == strcmp(func, "rename") \|\|
	0 == strcmp(func, "utime") \|\|
	0 == strcmp(func, "utimes") \|\|
	0 == strcmp(func, "unlink") \|\|
	0 == strcmp(func, "rmdir") \|\|
	0 == strcmp(func, "chown") \|\|
	0 == strcmp(func, "lchown") \|\|
	0 == strcmp(func, "chmod")))
	{
	struct stat tmp_stat;

	for (i = 0; i < sbcontext->num_write_denied_prefixes; i++)
	{
	if (0 == strncmp(filtered_path, sbcontext->write_denied_prefixes[i], strlen(sbcontext->write_denied_prefixes[i])))
	{
	result = 0;
	break;
	}
	}
	if (-1 == result)
	{
	for (i = 0; i < sbcontext->num_write_prefixes; i++)
	{
	if (0 == strncmp(filtered_path, sbcontext->write_prefixes[i], strlen(sbcontext->write_prefixes[i])))
	{
	result = 1;
	break;
	}
	}

	if (-1 == result)
	{
	/* hack to prevent mkdir of existing dirs to show errors */
	if (strcmp(func, "mkdir") == 0)
	{
	if (0 == stat(filtered_path, &tmp_stat))
	{
	sbcontext->show_access_violation = 0;
	result = 0;
	}
	}

	if (-1 == result)
	{
	for (i = 0; i < sbcontext->num_predict_prefixes; i++)
	{
	if (0 == strncmp(filtered_path, sbcontext->predict_prefixes[i], strlen(sbcontext->predict_prefixes[i])))
	{
	sbcontext->show_access_violation = 0;
	result = 0;
	break;
	}
	}
	}
	}
	}
	}
	}
	}

	if (-1 == result)
	{
	result = 0;
	}

	free(filtered_path);

	return result;
	}

	int check_syscall(sbcontext_t* sbcontext, const char* func, const char* file)
	{
	int result = 1;
	char* absolute_path = NULL;
	char* tmp_buffer = NULL;
	struct stat log_stat;
	char* log_path = NULL;
	int log_file = 0;
	struct stat debug_log_stat;
	char* debug_log_env = NULL;
	char* debug_log_path = NULL;
	int debug_log_file = 0;
	char buffer[512];

	if ('/' == file[0])
	{
	absolute_path = (char)malloc(sizeof(char)(strlen(file)+1));
	sprintf(absolute_path, "%s", file);
	}
	else
	{
	tmp_buffer = get_current_dir_name();
	absolute_path = (char)malloc(sizeof(char)(strlen(tmp_buffer)+1+strlen(file)+1));
	sprintf(absolute_path,"%s/%s", tmp_buffer, file);
	free(tmp_buffer);
	tmp_buffer = NULL;
	}

	log_path = getenv("SANDBOX_LOG");
	debug_log_env = getenv("SANDBOX_DEBUG");
	debug_log_path = getenv("SANDBOX_DEBUG_LOG");

	if ((NULL == log_path \|\| 0 != strcmp(absolute_path, log_path)) &&
	(NULL == debug_log_env \|\| NULL == debug_log_path \|\| 0 != strcmp(absolute_path, debug_log_path)) &&
	0 == check_access(sbcontext, func, absolute_path))
	{
	if (1 == sbcontext->show_access_violation)
	{
	fprintf(stderr, "\e[31;01mACCESS DENIED\033[0m %s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);

	if (NULL != log_path)
	{
	sprintf(buffer, "%s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);
	if (0 == lstat(log_path, &log_stat) &&
	0 == S_ISREG(log_stat.st_mode))
	{
	fprintf(stderr, "\e[31;01mSECURITY BREACH\033[0m %s already exists and is not a regular file.\n", log_path);
	}
	else
	{
	log_file = open(log_path, O_APPEND\|O_WRONLY\|O_CREAT, S_IRUSR\|S_IWUSR\|S_IRGRP\|S_IROTH);
	if(log_file >= 0)
	{
	write(log_file, buffer, strlen(buffer));
	close(log_file);
	}
	}
	}
	}

	result = 0;
	}
	else if (NULL != debug_log_env)
	{
	if (NULL != debug_log_path)
	{
	if (0 != strcmp(absolute_path, debug_log_path))
	{
	sprintf(buffer, "%s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);
	if (0 == lstat(debug_log_path, &debug_log_stat) &&
	0 == S_ISREG(debug_log_stat.st_mode))
	{
	fprintf(stderr, "\e[31;01mSECURITY BREACH\033[0m %s already exists and is not a regular file.\n", log_path);
	}
	else
	{
	debug_log_file = open(debug_log_path, O_APPEND\|O_WRONLY\|O_CREAT, S_IRUSR\|S_IWUSR\|S_IRGRP\|S_IROTH);
	if(debug_log_file >= 0)
	{
	write(debug_log_file, buffer, strlen(buffer));
	close(debug_log_file);
	}
	}
	}
	}
	else
	{
	fprintf(stderr, "\e[32;01mACCESS ALLOWED\033[0m %s:%*s%s\n", func, (int)(10-strlen(func)), "", absolute_path);
	}
	}

	free(absolute_path);
	absolute_path = NULL;

	return result;
	}

	int is_sandbox_on()
	{
	/* $SANDBOX_ACTIVE is an env variable that should ONLY
	* be used internal by sandbox.c and libsanbox.c. External
	* sources should NEVER set it, else the sandbox is enabled
	* in some cases when run in parallel with another sandbox,
	* but not even in the sandbox shell.
	*
	* Azarah (3 Aug 2002)
	*/
	if (NULL != getenv("SANDBOX_ON") &&
	0 == strcmp(getenv("SANDBOX_ON"), "1") &&
	NULL != getenv("SANDBOX_ACTIVE") &&
	0 == strcmp(getenv("SANDBOX_ACTIVE"), "armedandready"))
	{
	return 1;
	}
	else
	{
	return 0;
	}
	}

	int before_syscall(const char* func, const char* file)
	{
	int result = 1;

	sbcontext_t sbcontext;

	init_context(&sbcontext);

	init_env_entries(&(sbcontext.deny_prefixes), &(sbcontext.num_deny_prefixes), "SANDBOX_DENY", 1);
	init_env_entries(&(sbcontext.read_prefixes), &(sbcontext.num_read_prefixes), "SANDBOX_READ", 1);
	init_env_entries(&(sbcontext.write_prefixes), &(sbcontext.num_write_prefixes), "SANDBOX_WRITE", 1);
	init_env_entries(&(sbcontext.predict_prefixes), &(sbcontext.num_predict_prefixes), "SANDBOX_PREDICT", 1);

	result = check_syscall(&sbcontext, func, file);

	clean_env_entries(&(sbcontext.deny_prefixes), &(sbcontext.num_deny_prefixes));
	clean_env_entries(&(sbcontext.read_prefixes), &(sbcontext.num_read_prefixes));
	clean_env_entries(&(sbcontext.write_prefixes), &(sbcontext.num_write_prefixes));
	clean_env_entries(&(sbcontext.predict_prefixes), &(sbcontext.num_predict_prefixes));

	if (0 == result)
	{
	errno = EACCES;
	}

	return result;
	}

	int before_syscall_open_int(const char* func, const char* file, int flags)
	{
	if (flags & O_WRONLY \|\|
	flags & O_RDWR)
	{
	return before_syscall("open_wr", file);
	}
	else
	{
	return before_syscall("open_rd", file);
	}
	}

	int before_syscall_open_char(const char* func, const char* file, const char* mode)
	{
	if (strcmp(mode, "r") == 0 \|\|
	strcmp(mode, "rb") == 0)
	{
	return before_syscall("open_rd", file);
	}
	else
	{
	return before_syscall("open_wr", file);
	}
	}