From ead573b33839a309833f5c9191eb6565d67f7e2c Mon Sep 17 00:00:00 2001
From: David du Colombier <0intro@gmail.com>
Date: Wed, 22 Mar 2000 00:00:00 +0000
Subject: [PATCH] Plan 9 from Bell Labs 2000-03-22

---
 port/chan.c    | 15 +++++++++++++++
 port/error.h   |  1 +
 port/portdat.h |  2 ++
 port/sysfile.c |  3 +++
 port/sysproc.c |  8 ++++++++
 5 files changed, 29 insertions(+)

diff --git a/port/chan.c b/port/chan.c
index 8ca705a9b1863b09ff343197906e83f083a4d485..5b1165435c3b8fe4ad0d6b25a3d9768b58ea1f01 100644
--- a/port/chan.c
+++ b/port/chan.c
@@ -710,6 +710,21 @@ namec(char *name, int amode, int omode, ulong perm)
 		c = cclone(up->slash, 0);
 		break;
 	case '#':
+		/*
+		 *  noattach is sandboxing.
+		 *
+		 *  the OK exceptions are:
+		 *	|  it only gives access to pipes you create
+		 *	d  this process's file descriptors
+		 *	e  this process's environment
+		 *  the iffy exceptions are:
+		 *	c  time and pid, but also cons and consctl
+		 *	p  control of your own processes (and unfortunately
+		 *	   any others left unprotected)
+		 */
+		if(up->pgrp->noattach)
+		if(strchr("|decp", name[1]) == 0)
+			error(Enoattach);
 		cname = newcname(name);	/* save this before advancing */
 		mntok = 0;
 		elem[0] = 0;
diff --git a/port/error.h b/port/error.h
index 8badd47734f80e5d2a4e0dd553501a9eeb8bd758..61139ea5a5c0cbb24e73fc828f6af5506de47e6b 100644
--- a/port/error.h
+++ b/port/error.h
@@ -56,3 +56,4 @@ extern char Eshort[];		/* i/o count too small */
 extern char Egreg[];		/* xterm: Error 50, errno 1: Too big */
 extern char Ebadspec[];		/* bad attach specifier */
 extern char Enoreg[];		/* process has no saved registers */
+extern char Enoattach[];	/* mount/attach disallowed */
diff --git a/port/portdat.h b/port/portdat.h
index bf29b4edc4f45b6a955178371c30fb25e206e048..accdd19707953c35c05747b989e68688cae913bc 100644
--- a/port/portdat.h
+++ b/port/portdat.h
@@ -396,6 +396,7 @@ enum
 struct Pgrp
 {
 	Ref;				/* also used as a lock when mounting */
+	int	noattach;
 	ulong	pgrpid;
 	QLock	debug;			/* single access via devproc.c */
 	RWlock	ns;			/* Namespace n read/one write lock */
@@ -476,6 +477,7 @@ enum
 	RFCENVG		= (1<<11),
 	RFCFDG		= (1<<12),
 	RFREND		= (1<<13),
+	RFNOMNT		= (1<<14),
 };
 
 /*
diff --git a/port/sysfile.c b/port/sysfile.c
index dd41c9c47ebb48a7603d900c3ab2c201db8c8f05..2566364bb0a578bde7d43eb8b815efd23a4bf042 100644
--- a/port/sysfile.c
+++ b/port/sysfile.c
@@ -629,6 +629,9 @@ bindmount(ulong *arg, int ismount)
 	bogus.flags = flag & MCACHE;
 
 	if(ismount){
+		if(up->pgrp->noattach)
+			error(Enoattach);
+
 		bc = fdtochan(fd, ORDWR, 0, 1);
 		if(waserror()) {
 			cclose(bc);
diff --git a/port/sysproc.c b/port/sysproc.c
index dcd113372ca5b929cc2f504f33f7d82117b8af79..3242bbaa0a31299bd72fbedfb6e4e9fcf147d950 100644
--- a/port/sysproc.c
+++ b/port/sysproc.c
@@ -53,8 +53,12 @@ sysrfork(ulong *arg)
 			up->pgrp = newpgrp();
 			if(flag & RFNAMEG)
 				pgrpcpy(up->pgrp, opg);
+			/* inherit noattach */
+			up->pgrp->noattach = opg->noattach;
 			closepgrp(opg);
 		}
+		if(flag & RFNOMNT)
+			up->pgrp->noattach = 1;
 		if(flag & RFREND) {
 			org = up->rgrp;
 			up->rgrp = newrgrp();
@@ -121,11 +125,15 @@ sysrfork(ulong *arg)
 		p->pgrp = newpgrp();
 		if(flag & RFNAMEG)
 			pgrpcpy(p->pgrp, up->pgrp);
+		/* inherit noattach */
+		p->pgrp->noattach = up->pgrp->noattach;
 	}
 	else {
 		p->pgrp = up->pgrp;
 		incref(p->pgrp);
 	}
+	if(flag & RFNOMNT)
+		up->pgrp->noattach = 1;
 
 	if(flag & RFREND)
 		p->rgrp = newrgrp();