Presumably these mattered at some point in the past, but no longer.  Found
by clangd as invoked by Zed editor.  Not sure why direct clang-tidy runs
didn't spot these.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

It rarely matters, since we usually have getrandom(), but in case we don't
our open() of /dev/random was missing O_CLOEXEC, which can cause clang
warnings.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

We generally avoid trailing whitespace, but one slipped in.  Fix it.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

pasta_start_ns() creates UID and GID mappings for the user namespace in
which the child process runs.  We're going to want some more flexible
variants of this, so move it into a more general helper function
make_ugid_map() which will make a single user UID/GID mapping for the
userns owned by a given PID.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Include linux_dep.h for close_range() usage in isolation.c. And now
that the close_open_files() function which makes use of linux_dep.h
has been moved from util.c to isolation.c, we can safely remove the
header inclusion from util.c.

Link: https://github.com/gentoo/gentoo/pull/46644
Fixes: 0a510066e916 ("isolation: Move close_open_files() to isolate_fds()")
Signed-off-by: Jing Huang <rne.kou@icloud.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Usually fds 0-2 are stdin, stdout and stderr.  However, there are certain
use cases where passt can be invoked with one or more of those standard fds
closed.  In those cases, anything we open might be placed in one of the
standard slots.  For the handful of things we open early enough, this can
be a problem because we close fds 0-2 in __daemon(), replacing them with
dupes of /dev/null.

We could avoid closing those fds in __daemon() if they're not standard
streams.  However, leaving things other than the standard streams in fds
0-2 is a footgun: a stray printf() that occurs in a circumstance it
shouldn't could send harmful garbage to a device or socket.  It's also
likely to be confusing if debugging with strace or similar.

To avoid this, fill any missing standard streams with a dupe of /dev/null,
right after isolate_fds().  Since open()ing /dev/null itself could land in
one of those fd 0-2 slots, we need to be careful when we close it not to
leave a new gap.

Link: https://bugs.passt.top/show_bug.cgi?id=215
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Most functions in util.c are, well, utilities, that are useful in a bunch
of places.  close_open_files(), however, is very specific, it's only called
from isolate_initial(), and performs a very specific step of our self
isolation.  So, it makes more sense as a function in isolate.c - move it
there and rename it to isolate_fds().

In addition, call it directly from main() rather than from
isolate_initial().  That's pretty arbitrary now, but will make some
subsequent changes easier.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

The -F option is parsed in conf() along with everything else.  However,
because it informs what fds we can close at startup, we also have a special
case parse of it in close_open_files().

At present we duplicate the parsing and validation code, which is a bit
risky.  Avoid that with a conf_tap_fd() helper.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

It's a bit odd to have the listen(2) call for TCP listening sockets, down
deep in sock_l4_() conditional upon the epoll type passed in.  Move it to
pif_listen(), which is at least about listening, although it does still
need to be conditional on TCP.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

It seems the function pointer argument confuses cppcheck 2.21.0 (at least),
causing it to think do_clone()'s definition has different argument names
than it's declaration, even though that's not the case.  I made a minimal
reproducer and filed a cppcheck bug for this (see link).  In the meanwhile
work around it with an explicit suppression.

Link: https://trac.cppcheck.net/ticket/14847
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>