configurable trans-membrance hostcall blocklist

src/linux_fastcgi.cpp

@@ -130,7 +130,7 @@ void render_request_failure(Request& request, String title, String details, Stri
 	if(!request.resources.is_cli)
 	{
 		DValue error_info;
-		error_info["type"] = "runtime_error";
+		error_info["type"] = (title == "function disabled by server policy") ? "policy_blocked" : "runtime_error";
 		error_info["title"] = title;
 		error_info["details"] = details;
 		error_info["source"] = request.params["SCRIPT_FILENAME"];
@@ -533,9 +533,23 @@ int handle_complete(FastCGIRequest& request) {
 				request_fault_active = 1;
 				if(wasm_error != "")
 				{
-					failure_title = "wasm runtime error during request";
-					failure_details = "";
-					failure_trace = wasm_error;
+					size_t blocked_at = wasm_error.find("UCE_POLICY_BLOCKED:");
+					if(blocked_at != String::npos)
+					{
+						String fn = wasm_error.substr(blocked_at + 19);
+						size_t fn_end = fn.find_first_of(" \t\r\n\"");
+						if(fn_end != String::npos)
+							fn = fn.substr(0, fn_end);
+						failure_title = "function disabled by server policy";
+						failure_details = "this unit called " + fn + ", which is disabled on this server by configuration (UCE_HOSTCALL_BLOCKLIST)";
+						failure_trace = "";
+					}
+					else
+					{
+						failure_title = "wasm runtime error during request";
+						failure_details = "";
+						failure_trace = wasm_error;
+					}
 				}
 			};
 
@@ -1307,7 +1321,6 @@ void ensure_proactive_compiler()
 	}
 	if(p == 0)
 	{
-		file_release_process_locks("proactive compiler fork");
 		prctl(PR_SET_PDEATHSIG, SIGHUP);
 		run_proactive_compiler();
 		exit(0);
@@ -1329,7 +1342,6 @@ void listen_for_connections()
 	server.on_cli_complete = &handle_cli_complete;
 	for(;;)
 	{
-		file_release_process_locks("worker loop cleanup");
 		server.process(-1);
 	}
 }