[OLPC Security] Shutting down fds prior to execvpe in rainbow/inject.py: joyride 247 under Qemu

[Michael Stone]

On Tue, Nov 06, 2007 at 10:12:16PM -0500, Marcus Leech wrote:
> I experimentally put some code just before the execvpe() in inject.py to
> close FDs >= 3 and <= 10.  I picked 10 out of the
>   air, but I wouldn't expect there to be many open file descriptors at
> that point.  Actually, given the semantics of dup(),
>   you could use it to probe what the maximum FD number is just before
> execvpe(), so the terminating condition could
>   be something like <= dup(0).

Thanks for trying this. You should make yourself a clone of the security
repo at

  users/mleech/security

and I'll start pulling from you.

> Anyway everything appears to be sane after the experiment (that is to
> say, nothing is any *more* broken after this
>   compared to before this).
> 
> I note that Clock doesn't work at all (Stays in "Starting..." forever),

If you look at /home/olpc/.sugar/default/logs/shell.log you'll see that
Clock is crashing during startup trying to find 'clock.svg'.

> and eToys comes up, but bits of it fail with error dialogs, and
>   then there's no way to get out of it, 

I reported at least one part of this problem to Bert a day or two ago.
Just filed a ticket for it (#4703). We'll see if there are other
problems besides Etoys trying to create $SAR/sandbox.

> or return to the Sugar desktop--I had to go over to the virtual serial
> console and kill -1 it.

Yeah, this is a combination of a rainbow bug and a sugar bug. The
rainbow bug is that we aren't reporting the pid of the process we've
started for Rainbow to wait on.

The Sugar bug is that there's no way to remove the icon of an activity
that crashed during startup.

>   Logviewer hangs just like Clock.  So does MaMa Media Creative Center,
> and Record.    Hmmm.

Record has been crashing on startup for a long time (a week?) because
it's trying to mkdir() a directory that already exists.

MaMa Media Creative Center had a similar problem, though some of the
other MaMaMedia activities started fine (e.g. Joke Machine).

I'm not yet sure what's up with LogViewer.

Thanks for the comprehensive report!

Michael