[pypy-commit] pypy sandbox-2: backport from py3.6-sandbox-2

[arigo]

Author: Armin Rigo <arigo at tunes.org>
Branch: sandbox-2
Changeset: r97224:3f34199b0d1a
Date: 2019-08-20 12:44 +0200
http://bitbucket.org/pypy/pypy/changeset/3f34199b0d1a/

Log:	backport from py3.6-sandbox-2

diff --git a/rpython/rlib/_rsocket_rffi.py b/rpython/rlib/_rsocket_rffi.py
--- a/rpython/rlib/_rsocket_rffi.py
+++ b/rpython/rlib/_rsocket_rffi.py
@@ -1185,7 +1185,7 @@
 
 if _POSIX:
     dup = external('dup', [socketfd_type], socketfd_type, save_err=SAVE_ERR)
-    gai_strerror = external('gai_strerror', [rffi.INT], CCHARP)
+    gai_strerror = external('gai_strerror', [rffi.INT], CCHARP, sandboxsafe=True)
 
 #h_errno = c_int.in_dll(socketdll, 'h_errno')
 #
@@ -1217,21 +1217,21 @@
                        size_t, CCHARP, size_t, rffi.INT], rffi.INT)
 
 if sys.platform.startswith("openbsd") or sys.platform.startswith("darwin"):
-    htonl = external('htonl', [rffi.UINT], rffi.UINT, releasegil=False, macro=True)
-    htons = external('htons', [rffi.USHORT], rffi.USHORT, releasegil=False, macro=True)
-    ntohl = external('ntohl', [rffi.UINT], rffi.UINT, releasegil=False, macro=True)
-    ntohs = external('ntohs', [rffi.USHORT], rffi.USHORT, releasegil=False, macro=True)
+    htonl = external('htonl', [rffi.UINT], rffi.UINT, releasegil=False, macro=True, sandboxsafe=True)
+    htons = external('htons', [rffi.USHORT], rffi.USHORT, releasegil=False, macro=True, sandboxsafe=True)
+    ntohl = external('ntohl', [rffi.UINT], rffi.UINT, releasegil=False, macro=True, sandboxsafe=True)
+    ntohs = external('ntohs', [rffi.USHORT], rffi.USHORT, releasegil=False, macro=True, sandboxsafe=True)
 else:
-    htonl = external('htonl', [rffi.UINT], rffi.UINT, releasegil=False)
-    htons = external('htons', [rffi.USHORT], rffi.USHORT, releasegil=False)
-    ntohl = external('ntohl', [rffi.UINT], rffi.UINT, releasegil=False)
-    ntohs = external('ntohs', [rffi.USHORT], rffi.USHORT, releasegil=False)
+    htonl = external('htonl', [rffi.UINT], rffi.UINT, releasegil=False, sandboxsafe=True)
+    htons = external('htons', [rffi.USHORT], rffi.USHORT, releasegil=False, sandboxsafe=True)
+    ntohl = external('ntohl', [rffi.UINT], rffi.UINT, releasegil=False, sandboxsafe=True)
+    ntohs = external('ntohs', [rffi.USHORT], rffi.USHORT, releasegil=False, sandboxsafe=True)
 
 if _POSIX:
     inet_aton = external('inet_aton', [CCHARP, lltype.Ptr(in_addr)],
-                                rffi.INT)
+                                rffi.INT, sandboxsafe=True)
 
-inet_ntoa = external('inet_ntoa', [in_addr], rffi.CCHARP)
+inet_ntoa = external('inet_ntoa', [in_addr], rffi.CCHARP, sandboxsafe=True)
 
 
 inet_pton = external('inet_pton', [rffi.INT, rffi.CCHARP,
@@ -1242,7 +1242,7 @@
                                    socklen_t], CCHARP,
                      save_err=SAVE_ERR)
 
-inet_addr = external('inet_addr', [rffi.CCHARP], rffi.UINT)
+inet_addr = external('inet_addr', [rffi.CCHARP], rffi.UINT, sandboxsafe=True)
 socklen_t_ptr = lltype.Ptr(rffi.CFixedArray(socklen_t, 1))
 socketaccept = external('accept', [socketfd_type, sockaddr_ptr,
                                    socklen_t_ptr], socketfd_type,
@@ -1333,10 +1333,10 @@
                   rffi.INT,
                   save_err=SAVE_ERR)
 
-FD_CLR = external_c('FD_CLR', [rffi.INT, fd_set], lltype.Void, macro=True)
-FD_ISSET = external_c('FD_ISSET', [rffi.INT, fd_set], rffi.INT, macro=True)
-FD_SET = external_c('FD_SET', [rffi.INT, fd_set], lltype.Void, macro=True)
-FD_ZERO = external_c('FD_ZERO', [fd_set], lltype.Void, macro=True)
+FD_CLR = external_c('FD_CLR', [rffi.INT, fd_set], lltype.Void, macro=True, sandboxsafe=True)
+FD_ISSET = external_c('FD_ISSET', [rffi.INT, fd_set], rffi.INT, macro=True, sandboxsafe=True)
+FD_SET = external_c('FD_SET', [rffi.INT, fd_set], lltype.Void, macro=True, sandboxsafe=True)
+FD_ZERO = external_c('FD_ZERO', [fd_set], lltype.Void, macro=True, sandboxsafe=True)
 
 if _POSIX:
     pollfdarray = rffi.CArray(pollfd)
diff --git a/rpython/rlib/rposix.py b/rpython/rlib/rposix.py
--- a/rpython/rlib/rposix.py
+++ b/rpython/rlib/rposix.py
@@ -1172,7 +1172,7 @@
     return rffi.charp2str(l_name)
 
 c_strerror = external('strerror', [rffi.INT], rffi.CCHARP,
-                      releasegil=False)
+                      releasegil=False, sandboxsafe=True)
 
 @replace_os_function('strerror')
 def strerror(errnum):
diff --git a/rpython/rlib/rsiphash.py b/rpython/rlib/rsiphash.py
--- a/rpython/rlib/rsiphash.py
+++ b/rpython/rlib/rsiphash.py
@@ -139,6 +139,8 @@
         translator = hop.rtyper.annotator.translator
         if translator.config.translation.reverse_debugger:
             return    # ignore and use the regular hash, with reverse-debugger
+        if translator.config.translation.sandbox:
+            return    # ignore and use the regular hash, with sandboxing
         bk = hop.rtyper.annotator.bookkeeper
         s_callable = bk.immutablevalue(initialize_from_env)
         r_callable = hop.rtyper.getrepr(s_callable)
diff --git a/rpython/rlib/rurandom.py b/rpython/rlib/rurandom.py
--- a/rpython/rlib/rurandom.py
+++ b/rpython/rlib/rurandom.py
@@ -6,7 +6,7 @@
 import errno
 
 from rpython.rtyper.lltypesystem import lltype, rffi
-from rpython.rlib.objectmodel import not_rpython
+from rpython.rlib.objectmodel import not_rpython, fetch_translated_config
 from rpython.translator.tool.cbuild import ExternalCompilationInfo
 from rpython.rtyper.tool import rffi_platform
 
@@ -148,7 +148,9 @@
         # initialize the random seed of string hashes
         result = []
         if SYS_getrandom is not None:
-            n = _getrandom(n, result, signal_checker)
+            config = fetch_translated_config()
+            if config is None or not config.translation.sandbox:
+                n = _getrandom(n, result, signal_checker)
         if n <= 0:
             return ''.join(result)