tame 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: e9d2493ff758b598a3988a39552012eb3b086e22
+  data.tar.gz: 6ed68100d75fc8fc524ba0955b3d4f5d18f53139
+SHA512:
+  metadata.gz: 1afe5a3f09dc781dd35e3c70720434178861aec0aa9171453929c34842b022d003bb940f59d05857cc73db44f096b0b689db3cc1de02cfbec265200809755bc0
+  data.tar.gz: eb16dcd0a7b6b5b981ca3f9eb7c8e41648d2668bf4022d10060f51e854f3fb10631861a3ca7bb8a5e2df2b577dfab0f587914787bff14486f8a5ebecf3e057db

data/CHANGELOG

@@ -0,0 +1,3 @@
+=== 1.0.0 (2015-07-20)
+
+* Initial Public Release

data/MIT-LICENSE

@@ -0,0 +1,18 @@
+Copyright (c) 2015 Jeremy Evans
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,111 @@
+= tame
+
+tame exposes OpenBSD's tame(2) system call to ruby, allowing a
+program to restrict the types of operations the program
+can do after that point.  Unlike other similar systems,
+tame is specifically designed for programs that need to
+use a wide variety of operations on initialization, but
+a fewer number after initialization (when user input will
+be accepted).
+
+tame(2) is supported on OpenBSD 5.8+.
+
+== Usage
+
+First, you need to require the library
+
+  require 'tame'
+
+Then you can use +Tame.tame+ as the interface to the tame(2) system
+call.  You pass +Tame.tame+ symbols representing the operations you
+would like to allow.  For example, if you want to give the process
+the ability to read from the the file system, but not read from the
+file system or allow network access:
+
+  Tame.tame(:rpath)
+
+To allow read/write filesystem access, but not network access:
+
+  Tame.tame(:rpath, :wpath, :cpath)
+
+To allow inet/unix socket access and DNS queries, but not
+filesystem access:
+
+  Tame.tame(:inet, :unix, :dns)
+
++Tame+ is a module that extends itself, you can include it
+in other classes:
+
+  Object.send(:include, Tame)
+  tame(:rpath)
+
+== Options
+
+Here are the symbols that are supported, along with the tame(2)
+permission they grant.
+
+:abort :: TAME_ABORT
+:cmsg :: TAME_CMSG
+:cpath :: TAME_CPATH
+:dns :: TAME_DNS
+:getpw :: TAME_GETPW
+:inet :: TAME_INET
+:ioctl :: TAME_IOCTL
+:proc :: TAME_PROC
+:rpath :: TAME_RPATH
+:tmppath :: TAME_TMPPATH
+:unix :: TAME_UNIX
+:wpath :: TAME_WPATH
+
+Using an unsupported symbol will raise an exception.  The TAME_STDIO
+permission is automatically used, as ruby does not function without
+it.  See the tame(2) manual for details about what permissions the
+options grant.
+
+== Reporting issues/bugs
+
+This library uses GitHub Issues for tracking issues/bugs:
+
+  https://github.com/jeremyevans/tame_libs/issues
+
+== Contributing
+
+The source code is on GitHub:
+
+  https://github.com/jeremyevans/tame_libs/tree/master/ruby
+
+To get a copy:
+
+  git clone git://github.com/jeremyevans/tame_libs.git
+
+== Requirements
+
+* OpenBSD 5.8+
+* ruby 1.8.7+
+* rake-compiler (if compiling)
+
+== Compiling
+
+To build the library from a git checkout, use the compile task.
+
+  rake compile
+
+== Running the specs
+
+The rake spec task runs the specs.  This is also the default rake
+task.  This will compile the library if not already compiled. 
+
+  rake
+
+== Known Issues
+
+* You cannot create new threads after running +Tame.tame+, as
+  it uses syscalls that are not currently allowed by tame(2).  +fork+
+  still works.
+
+* You cannot currently test +Tame.tame+ in irb/pry, as they use an
+  ioctl that is not currently allowed by tame(2).
+
+== Author
+
+Jeremy Evans <code@jeremyevans.net>

data/Rakefile

@@ -0,0 +1,30 @@
+require "rake"
+require "rake/clean"
+
+CLEAN.include %w'**.rbc rdoc'
+
+desc "Do a full cleaning"
+task :distclean do
+  CLEAN.include %w'tmp pkg tame*.gem lib/*.so'
+  Rake::Task[:clean].invoke
+end
+
+desc "Build the gem"
+task :package do
+  sh %{gem build tame.gemspec}
+end
+
+desc "Run specs"
+task :spec => :compile do
+  ruby = ENV['RUBY'] ||= FileUtils::RUBY 
+  sh %{#{ruby} spec/tame_spec.rb}
+end
+
+desc "Run specs"
+task :default => :spec
+
+begin
+  require 'rake/extensiontask'
+  Rake::ExtensionTask.new('tame')
+rescue LoadError
+end

data/ext/tame/extconf.rb

@@ -0,0 +1,4 @@
+require 'mkmf'
+have_header 'tame'
+$CFLAGS << " -O0 -g -ggdb" if ENV['DEBUG']
+create_makefile("tame")

data/ext/tame/tame.c

@@ -0,0 +1,45 @@
+#include <ruby.h>
+#include <sys/tame.h>
+
+static VALUE cTameFlags;
+
+static VALUE rb_tame(int argc, VALUE *argv, VALUE self) {
+  /* required for ruby to work */
+  int tame_flags = TAME_STDIO;
+  int i;
+  VALUE v;
+
+  for(i = 0; i < argc; i++) {
+    v = rb_hash_aref(cTameFlags, argv[i]);
+    if (RTEST(v) == 0) {
+      rb_raise(rb_eArgError, "unsupported tame argument");
+    }
+    tame_flags |= FIX2INT(v);
+  }
+
+  tame(tame_flags);
+  return Qnil;
+}
+
+void Init_tame(void) {
+  VALUE cTame;
+  cTame = rb_define_module("Tame");
+  rb_define_method(cTame, "tame", rb_tame, -1);
+  rb_extend_object(cTame, cTame);
+
+  cTameFlags = rb_hash_new();
+  rb_global_variable(&cTameFlags);
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("abort")), INT2FIX(TAME_ABORT));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("cmsg")), INT2FIX(TAME_CMSG));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("cpath")), INT2FIX(TAME_CPATH));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("dns")), INT2FIX(TAME_DNS));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("getpw")), INT2FIX(TAME_GETPW));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("inet")), INT2FIX(TAME_INET));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("ioctl")), INT2FIX(TAME_IOCTL));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("proc")), INT2FIX(TAME_PROC));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("rpath")), INT2FIX(TAME_RPATH));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("tmppath")), INT2FIX(TAME_TMPPATH));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("unix")), INT2FIX(TAME_UNIX));
+  rb_hash_aset(cTameFlags, ID2SYM(rb_intern("wpath")), INT2FIX(TAME_WPATH));
+  rb_hash_freeze(cTameFlags);
+}

metadata

@@ -0,0 +1,67 @@
+--- !ruby/object:Gem::Specification
+name: tame
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Jeremy Evans
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-07-20 00:00:00.000000000 Z
+dependencies: []
+description: |
+  tame exposes OpenBSD's tame(2) system call to ruby, allowing a
+  program to restrict the types of operations the program
+  can do after that point.  Unlike other similar systems,
+  tame is specifically designed for programs that need to
+  use a wide variety of operations on initialization, but
+  a fewer number after initialization (when user input will
+  be accepted).
+email: code@jeremyevans.net
+executables: []
+extensions:
+- ext/tame/extconf.rb
+extra_rdoc_files:
+- README.rdoc
+- CHANGELOG
+- MIT-LICENSE
+files:
+- CHANGELOG
+- MIT-LICENSE
+- README.rdoc
+- Rakefile
+- ext/tame/extconf.rb
+- ext/tame/tame.c
+homepage: http://github.com/jeremyevans/tame_libs/ruby
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options:
+- "--quiet"
+- "--line-numbers"
+- "--inline-source"
+- "--title"
+- 'tame: restrict system operations on OpenBSD'
+- "--main"
+- README.rdoc
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 1.8.7
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.5
+signing_key: 
+specification_version: 4
+summary: Restrict system operations on OpenBSD
+test_files: []