/*
 * sbox.h -- definitions for the script box
 * Copyright 1997-1998, Lincoln D. Stein
 * $Revision: 1.3 $
 */

#ifndef _SBOX_H
#define _SBOX_H
#define TRUE  1
#define FALSE 0
#define DIRECTORY 1
#define TARGET 0

/******        USER CONFIGURABLE DEFINES      ******/

/********************* GENERAL *******************/
/*
 * WEB_USER  -- user that the Web server runs as
 */
#ifndef WEB_USER
#define WEB_USER "nobody"
#endif

/*
 * WEB_GROUP  -- group that the Web server runs as
 */
#ifndef WEB_GROUP
#define WEB_GROUP "nogroup"
#endif

/*
 * UID_MIN  -- lowest UID that we will suid to
 */
#ifndef UID_MIN
#define UID_MIN 100
#endif

/*
 * GID_MIN  -- lowest UID that we will sgid to
 */
#ifndef GID_MIN
#define GID_MIN 100
#endif

/* SAFE_PATH -- this is the path that will be placed in the environment.
 * Script will be running chroot to the user's home directory, so these 
 * directories may not be available.
 */
#ifndef SAFE_PATH
#define SAFE_PATH "/bin:/usr/bin:/usr/local/bin"
#endif

/********************* LOGGING *******************/
/*
 * LOG_FILE  -- log what sbox does.  If undefined, won't log.
 *              If an empty string, logs to standard error.
 */
#ifndef LOG_FILE
/* #define LOG_FILE "/home/httpd/logs/sbox.log" */
#define LOG_FILE ""
#endif

/*
 * ECHO_FAILURES  -- If set to TRUE, will echo fatal error messages
 *              to the browser.  Set to FALSE to inhibit error messages.
 */
#ifndef ECHO_FAILURES
#define ECHO_FAILURES TRUE
#endif

/******************* CHROOT CONFIG ******************/
/* DO_CHROOT -- if set to TRUE, sbox will
 * do a chroot to the user's home directory.
 */
#ifndef DO_CHROOT
#define DO_CHROOT TRUE
#endif

/*
 * ROOT
 * Directory to which sbox will chroot(), relative to the author's
 * document root.
 */
#ifndef ROOT
#define ROOT ".."
#endif

/*
 * CGI_BIN
 * Directory in which users' executables must reside, relative to their
 * document root.  For best results, this must be contained within ROOT.
 */
#ifndef CGI_BIN
#define CGI_BIN "../cgi-bin"
#endif

/************** SUID/SGID CONFIG ***************/
/* DO_SUID and DO_SGID -- if set to TRUE, sbox
 * will SUID and/or SGID to the user and group ownership of
 * the _directory_ in which the target script is found
 */
#ifndef DO_SUID
#define DO_SUID TRUE
#endif

#ifndef DO_SGID
#define DO_SGID TRUE
#endif

/* Determine whether to use the ownerships of the script or the _directory_
 * that the script is found in for the SUID/SGID IDs.  Legal values are
 * DIRECTORY and TARGET
 */
#ifndef SID_MODE
#define SID_MODE DIRECTORY
/* #define SID_MODE TARGET */
#endif


/*
 * RESOURCE LIMITS -- hard and soft.  Set to RLIM_INFINITY for no limits.
 * Soft limits can be increased by the application.  Hard limits cannot be
 * changed.
 */

/* Whether or not you want to set limits at all.
 * If your sytem does not have <sys/resource.h>, then you will
 * need to set this to FALSE.
 */
#ifndef SET_LIMITS
#define SET_LIMITS TRUE
#endif

#define ONEK 1024

/* priority */
#ifndef PRIORITY
#define PRIORITY 10
#endif

/* maximum CPU time */
#ifndef LIMIT_CPU_HARD
#define LIMIT_CPU_HARD 120 /* CPU seconds */
#endif

#ifndef LIMIT_CPU_SOFT
#define LIMIT_CPU_SOFT 10 /* CPU seconds */
#endif

/* maximum size of a single file that can be created (blocks) */
#ifndef LIMIT_FSIZE_HARD
#define LIMIT_FSIZE_HARD 2048 * ONEK /* two megabytes */
#endif

#ifndef LIMIT_FSIZE_SOFT
#define LIMIT_FSIZE_SOFT 100 * ONEK /* 100K */
#endif

/* maximum amount of in-memory data */
#ifndef LIMIT_DATA_HARD
#define LIMIT_DATA_HARD  8192 * ONEK /* eight megabytes */
#endif

#ifndef LIMIT_DATA_SOFT
#define LIMIT_DATA_SOFT  1024 * ONEK /* one megabyte */
#endif

/* maximum stack size */
#ifndef LIMIT_STACK_HARD
#define LIMIT_STACK_HARD 8192 * ONEK /* eight megabytes */
#endif

#ifndef LIMIT_STACK_SOFT
#define LIMIT_STACK_SOFT  1024 * ONEK /* one megabyte */
#endif

/* core dump size */
#ifndef LIMIT_CORE_HARD
#define LIMIT_CORE_HARD 0 /* don't allow core dumps */
#endif

#ifndef LIMIT_CORE_SOFT
#define LIMIT_CORE_SOFT 0 /* don't allow core dumps */
#endif

/* maximum memory ("resident set") usage */
#ifndef LIMIT_RSS_HARD
#define LIMIT_RSS_HARD 8192 * ONEK /* eight megs */
#endif

#ifndef LIMIT_RSS_SOFT
#define LIMIT_RSS_SOFT 1024 * ONEK /* one meg */
#endif

/* max number of processes script can spawn */
#ifndef LIMIT_NPROC_HARD
#define LIMIT_NPROC_HARD 256
#endif

#ifndef LIMIT_NPROC_SOFT
#define LIMIT_NPROC_SOFT 32
#endif

/* max number of open file descriptors */
#ifndef LIMIT_NOFILE_HARD
#define LIMIT_NOFILE_HARD 256
#endif

#ifndef LIMIT_NOFILE_SOFT
#define LIMIT_NOFILE_SOFT 32
#endif

#define SETLIMIT(a) limit.rlim_cur = LIMIT_##a##_SOFT; \
                    limit.rlim_max = LIMIT_##a##_HARD; \
                    if (setrlimit(RLIMIT_##a,&limit)<0) \
		       fatal_error("Couldn't set limit: %s",strerror(errno));

/* This is a canned error statement */
#ifndef CANNED_ERROR
#define CANNED_ERROR \
"<HTML><HEAD><TITLE>Sbox Error</TITLE></HEAD> <BODY> \
<H1>Sbox Error</H1>
The <A HREF=\"http://www.genome.wi.mit.edu/~lstein/sbox/\">sbox</A> \
program encountered an error while processing this URL.  Please note \
the time of the error, anything you might have been doing at the time \
to trigger the problem, and forward the information to this site's \
Webmaster. <HR> \
</BODY> \
</HTML>"
#endif

#endif /* _SBOX_H */
