From bbb8f6d7d1b73e3d8f62122380a64c3a97af72f8 Mon Sep 17 00:00:00 2001 From: Moe-hacker Date: Thu, 30 May 2024 12:34:13 +0800 Subject: [PATCH] Pass clang-tidy --- Makefile | 3 +++ src/rootless.c | 14 +++++++------- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index 1bcf6f7..15f2797 100644 --- a/Makefile +++ b/Makefile @@ -44,6 +44,9 @@ STRIP = strip FORMATER = clang-format -i SRC = src/*.c HEADER = src/include/*.h +# Checker. +CHECKER = clang-tidy +CHECKER_FLAGS = --checks=*,-clang-analyzer-security.insecureAPI.strcpy,-altera-unroll-loops,-cert-err33-c,-concurrency-mt-unsafe,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,-readability-function-cognitive-complexity,-cppcoreguidelines-avoid-magic-numbers,-readability-magic-numbers,-bugprone-easily-swappable-parameters,-cert-err34-c,-misc-include-cleaner,-readability-identifier-length,-bugprone-signal-handler,-cert-msc54-cpp,-cert-sig30-c,-altera-id-dependent-backward-branch,-bugprone-suspicious-realloc-usage,-hicpp-signed-bitwise,-clang-analyzer-security.insecureAPI.UncheckedReturn include config.mk # Target. objects = anime.o caplist.o chroot.o cprintf.o info.o rurienv.o seccomp.o signal.o umount.o unshare.o rootless.o mount.o k2v.o elf-magic.o config.o cgroup.o main.o diff --git a/src/rootless.c b/src/rootless.c index bd44650..860732f 100644 --- a/src/rootless.c +++ b/src/rootless.c @@ -46,19 +46,19 @@ static void init_rootless_container(struct CONTAINER *container) mount("proc", "./proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL); mkdir("./dev", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("tmpfs", "./dev", "tmpfs", MS_NOSUID, "size=65536k,mode=755"); - creat("./dev/tty", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); + open("./dev/tty", O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("/dev/tty", "./dev/tty", NULL, MS_BIND, NULL); - creat("./dev/console", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); + open("./dev/console", O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("/dev/console", "./dev/console", NULL, MS_BIND, NULL); - creat("./dev/null", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); + open("./dev/null", O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("/dev/null", "./dev/null", NULL, MS_BIND, NULL); - creat("./dev/ptmx", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); + open("./dev/ptmx", O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("/dev/ptmx", "./dev/ptmx", NULL, MS_BIND, NULL); - creat("./dev/random", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); + open("./dev/random", O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("/dev/random", "./dev/random", NULL, MS_BIND, NULL); - creat("./dev/urandom", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); + open("./dev/urandom", O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("/dev/urandom", "./dev/urandom", NULL, MS_BIND, NULL); - creat("./dev/zero", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); + open("./dev/zero", O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mount("/dev/zero", "./dev/zero", NULL, MS_BIND, NULL); symlink("/proc/self/fd", "./dev/fd"); symlink("/proc/self/fd/0", "./dev/stdin");