23 using namespace clang;
29 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
31 bool isRootChanged(
intptr_t k) {
return k == ROOT_CHANGED; }
41 class ChrootChecker :
public Checker<eval::Call, check::PreStmt<CallExpr> > {
44 mutable std::unique_ptr<BuiltinBug> BT_BreakJail;
47 ChrootChecker() : II_chroot(
nullptr), II_chdir(
nullptr) {}
49 static void *getTag() {
93 state = Mgr.
addGDM(state, ChrootChecker::getTag(), (
void*) ROOT_CHANGED);
102 const void *k = state->FindGDM(ChrootChecker::getTag());
112 if (
const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
115 state = Mgr.
addGDM(state, ChrootChecker::getTag(),
116 (
void*) JAIL_ENTERED);
140 void *
const* k = C.
getState()->FindGDM(ChrootChecker::getTag());
146 this,
"Break out of jail",
"No call of chdir(\"/\") immediately " 149 *BT_BreakJail, BT_BreakJail->getDescription(), N));
ProgramStateRef addGDM(ProgramStateRef St, void *Key, void *Data)
Represents a function declaration or definition.
MemRegion - The root abstract class for all memory regions.
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
One of these records is kept for each identifier that is lexed.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
__INTPTR_TYPE__ intptr_t
A signed integer type with the property that any valid pointer to void can be converted to this type...
StringRef getString() const
Expr - This represents one expression.
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
CHECKER * registerChecker(AT... Args)
Used to register checkers.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
const MemRegion * getAsRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Dataflow Directional Tag Classes.
ASTContext & getASTContext()
const ProgramStateRef & getState() const
StringLiteral - This represents a string literal expression, e.g.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
StringRegion - Region associated with a StringLiteral.