New application "umlwrap". Runs a single untrusted process in an
isolation environment based on User-Mode Linux; passes its I/O back
and forth and returning its exit code, while preventing it from
doing any network access or from writing to any parts of the
filesystem you don't specifically let it write to. As an added
bonus, if the UML kernel you're using has unionfs built in, it can
union-mount trees over the root of the interior VFS; so if you have,
say, a set of binaries which are not just untrusted but also contain
hard-coded paths which require them to be installed in /usr, you can
easily arrange for them to appear in /usr in the isolation
environment, solving both problems in one go.

UML's communication-with-the-outside-world facilities are mostly set
up for persistent virtual machines with full Linux systems inside
them rather than encapsulations of one process at a time; it's taken
a significant amount of work to turn UML into a really viable
one-process wrapper.


git-svn-id: svn://svn.tartarus.org/sgt@8070 cda61777-01e9-0310-a592-d414129be87e
Fix warnings. (There's always _something_ I'll miss in my first
proper checkin! This is what I get for accidentally compiling
without -Wall for the past hour.)


git-svn-id: svn://svn.tartarus.org/sgt@8072 cda61777-01e9-0310-a592-d414129be87e
More warnings acquired by compiling on atreus. (Hence, I have to
assume, they're 64-bit-cleanliness related.)


git-svn-id: svn://svn.tartarus.org/sgt@8073 cda61777-01e9-0310-a592-d414129be87e
Man page, --help, and install instructions. Also licence file and
--licence. Also, while I'm here, remove the -t, -T and --pty-auto
options, since they never actually did anything and I think I must
have put them in before I'd fully figured out my eventual pty
handling design.


git-svn-id: svn://svn.tartarus.org/sgt@8076 cda61777-01e9-0310-a592-d414129be87e
Commit a TODO with some variously short-, long- and very-long-range
thoughts.


git-svn-id: svn://svn.tartarus.org/sgt@8077 cda61777-01e9-0310-a592-d414129be87e
Knew there was something I'd forgotten to put in here.


git-svn-id: svn://svn.tartarus.org/sgt@8078 cda61777-01e9-0310-a592-d414129be87e
Reword an unclear paragraph, and replace an "I don't know how to do
this" parenthesis with the results of a little research.


git-svn-id: svn://svn.tartarus.org/sgt@8079 cda61777-01e9-0310-a592-d414129be87e
Add the -S option to execute a command as root before dropping
privileges. Also add some automated umounts and syncs at termination
time, so that -S can usefully be used to mount filesystems without
worrying about leaving them in unclean/unsynced states on exit.


git-svn-id: svn://svn.tartarus.org/sgt@8080 cda61777-01e9-0310-a592-d414129be87e
Automatically mount writable tmpfses in /tmp and /var/tmp. Also
mount one over /dev and fill it with the (roughly) right set of
device files for umlwrap. (No point having the exterior /dev show
through when it'll be mostly filled with irrelevant drivel;
additionally, this behaviour is more useful in applications which
have custom root directories.)


git-svn-id: svn://svn.tartarus.org/sgt@8081 cda61777-01e9-0310-a592-d414129be87e
Fix a couple of fd-handling bugs. The outer side of umlwrap was
occasionally trying to read from an original fd tagged as write-only
or vice versa; and when I fixed that, it uncovered the fact that
when two protocopy instances were attached to the same fd (one
reading, one writing) then the death of one instance would close the
fd and critically inconvenience the other. Both fixed.


git-svn-id: svn://svn.tartarus.org/sgt@8082 cda61777-01e9-0310-a592-d414129be87e
Allow the --fd-* options to override the r/w status of the default
fds, and more generally allow them not to get confused if the same
fd number is specified more than once.


git-svn-id: svn://svn.tartarus.org/sgt@8083 cda61777-01e9-0310-a592-d414129be87e
"man termios" claims that ECHOCTL has no effect if ECHO is not also
set. It lies to us! Disable ECHOCTL explicitly, and one or two
others I noticed on my way here.


git-svn-id: svn://svn.tartarus.org/sgt@8084 cda61777-01e9-0310-a592-d414129be87e
If protocopy_encode gets a read error, it must send CMD_EOF, or else
the outer umlwrap will block for ever waiting for a CMD_EOF on that
channel which will never arrive.


git-svn-id: svn://svn.tartarus.org/sgt@8085 cda61777-01e9-0310-a592-d414129be87e
More fd-handling fixes, with the combined effect that EOFs are now
successfully propagated down output channels from the isolated
process to the holder of the other end of the fds originally passed
to umlwrap. Fixes include:
 - the interior init process closes its copies of all the fds it
   passed to its child, so as not to inhibit EOF on the other ends
   of those pipes
 - umlwrap's child processes carefully close _their_ copies of all
   the fds umlwrap inherited from its parent, so as not to inhibit
   EOF on the other ends of them
 - umlwrap's protocopy_decodes now close or shutdown their wfds as
   appropriate
 - duplicate copies of outgoing non-tty fds are closed so that when
   a protocopy_decode shuts the last one it will actually help.
Additionally, I've turned the UML console pipe into a two-way
socketpair so as to put it on UML's standard input as well; my
previous solution for UML's standard input was working rather badly
because UML somehow apparently managed to write to the other end of
the pipe.


git-svn-id: svn://svn.tartarus.org/sgt@8086 cda61777-01e9-0310-a592-d414129be87e
TODO item that occurred to me yesterday and I forgot to write it down.


git-svn-id: svn://svn.tartarus.org/sgt@8089 cda61777-01e9-0310-a592-d414129be87e
Paranoid check to avoid segfaulting in the case where getcwd fails
(e.g. because umlwrap's current directory has been rmdirred).


git-svn-id: svn://svn.tartarus.org/sgt@8858 cda61777-01e9-0310-a592-d414129be87e
Switch umlwrap's union-mounting from using the old 'unionfs', which
isn't supported in up-to-date kernels, to 'aufs' which is still
reasonably up-to-date at aufs.sourceforge.net .


git-svn-id: svn://svn.tartarus.org/sgt@9862 cda61777-01e9-0310-a592-d414129be87e
Update docs for the unionfs->aufs change.


git-svn-id: svn://svn.tartarus.org/sgt@9863 cda61777-01e9-0310-a592-d414129be87e