27
27
#include <stdlib.h> /* malloc(), exit(), EXIT_FAILURE,
28
28
EXIT_SUCCESS, realloc() */
29
29
#include <stdbool.h> /* bool, true, false */
30
#include <stdio.h> /* perror, popen(), fileno(),
31
fprintf(), stderr, STDOUT_FILENO */
30
#include <stdio.h> /* perror, fileno(), fprintf(),
31
stderr, STDOUT_FILENO */
32
32
#include <sys/types.h> /* DIR, opendir(), stat(), struct
33
33
stat, waitpid(), WIFEXITED(),
34
34
WEXITSTATUS(), wait(), pid_t,
176
179
/* Add to a plugin's environment */
177
static bool add_environment(plugin *p, const char *def){
180
static bool add_environment(plugin *p, const char *def, bool replace){
184
/* namelen = length of name of environment variable */
185
size_t namelen = (size_t)(strchrnul(def, '=') - def);
186
/* Search for this environment variable */
187
for(char **e = p->environ; *e != NULL; e++){
188
if(strncmp(*e, def, namelen + 1) == 0){
189
/* It already exists */
191
char *new = realloc(*e, strlen(def) + 1);
181
201
return add_to_char_array(def, &(p->environ), &(p->envc));
186
205
* Based on the example in the GNU LibC manual chapter 13.13 "File
187
206
* Descriptor Flags".
188
207
* *Note File Descriptor Flags:(libc)Descriptor Flags.
190
static int set_cloexec_flag(int fd)
209
static int set_cloexec_flag(int fd){
192
210
int ret = fcntl(fd, F_GETFD, 0);
193
211
/* If reading the flags failed, return error indication now. */
250
static void free_plugin_list(plugin *plugin_list){
251
for(plugin *next; plugin_list != NULL; plugin_list = next){
252
next = plugin_list->next;
253
for(char **arg = plugin_list->argv; *arg != NULL; arg++){
256
free(plugin_list->argv);
257
for(char **env = plugin_list->environ; *env != NULL; env++){
260
free(plugin_list->environ);
265
/* Removes and free a plugin from the plugin list */
266
static void free_plugin(plugin *plugin_node){
268
for(char **arg = plugin_node->argv; *arg != NULL; arg++){
271
free(plugin_node->argv);
272
for(char **env = plugin_node->environ; *env != NULL; env++){
275
free(plugin_node->environ);
276
free(plugin_node->buffer);
278
/* Removes the plugin from the singly-linked list */
279
if(plugin_node == plugin_list){
280
/* First one - simple */
281
plugin_list = plugin_list->next;
283
/* Second one or later */
284
for(plugin *p = plugin_list; p != NULL; p = p->next){
285
if(p->next == plugin_node){
286
p->next = plugin_node->next;
295
static void free_plugin_list(void){
296
while(plugin_list != NULL){
297
free_plugin(plugin_list);
265
301
int main(int argc, char *argv[]){
266
const char *plugindir = "/lib/mandos/plugins.d";
267
const char *argfile = ARGFILE;
302
char *plugindir = NULL;
303
char *argfile = NULL;
269
305
size_t d_name_len;
302
338
{ .name = "global-options", .key = 'g',
303
339
.arg = "OPTION[,OPTION[,...]]",
304
340
.doc = "Options passed to all plugins" },
305
{ .name = "global-envs", .key = 'e',
341
{ .name = "global-env", .key = 'G',
306
342
.arg = "VAR=value",
307
343
.doc = "Environment variable passed to all plugins" },
308
344
{ .name = "options-for", .key = 'o',
309
345
.arg = "PLUGIN:OPTION[,OPTION[,...]]",
310
346
.doc = "Options passed only to specified plugin" },
311
{ .name = "envs-for", .key = 'f',
347
{ .name = "env-for", .key = 'E',
312
348
.arg = "PLUGIN:ENV=value",
313
349
.doc = "Environment variable passed to specified plugin" },
314
350
{ .name = "disable", .key = 'd',
316
352
.doc = "Disable a specific plugin", .group = 1 },
353
{ .name = "enable", .key = 'e',
355
.doc = "Enable a specific plugin", .group = 1 },
317
356
{ .name = "plugin-dir", .key = 128,
318
357
.arg = "DIRECTORY",
319
358
.doc = "Specify a different plugin directory", .group = 2 },
320
{ .name = "userid", .key = 129,
321
.arg = "ID", .flags = 0,
322
.doc = "User ID the plugins will run as", .group = 2 },
323
{ .name = "groupid", .key = 130,
324
.arg = "ID", .flags = 0,
325
.doc = "Group ID the plugins will run as", .group = 2 },
326
{ .name = "debug", .key = 131,
327
.doc = "Debug mode", .group = 3 },
359
{ .name = "config-file", .key = 129,
361
.doc = "Specify a different configuration file", .group = 2 },
362
{ .name = "userid", .key = 130,
363
.arg = "ID", .flags = 0,
364
.doc = "User ID the plugins will run as", .group = 3 },
365
{ .name = "groupid", .key = 131,
366
.arg = "ID", .flags = 0,
367
.doc = "Group ID the plugins will run as", .group = 3 },
368
{ .name = "debug", .key = 132,
369
.doc = "Debug mode", .group = 4 },
331
error_t parse_opt (int key, char *arg, struct argp_state *state) {
332
/* Get the INPUT argument from `argp_parse', which we know is a
333
pointer to our plugin list pointer. */
334
plugin **plugins = state->input;
373
error_t parse_opt (int key, char *arg, __attribute__((unused))
374
struct argp_state *state) {
376
case 'g': /* --global-options */
337
377
if (arg != NULL){
339
379
while((p = strsep(&arg, ",")) != NULL){
340
380
if(p[0] == '\0'){
343
if(not add_argument(getplugin(NULL, plugins), p)){
383
if(not add_argument(getplugin(NULL), p)){
344
384
perror("add_argument");
345
385
return ARGP_ERR_UNKNOWN;
390
case 'G': /* --global-env */
355
char *envdef = strdup(arg);
359
if(not add_environment(getplugin(NULL, plugins), envdef)){
360
perror("add_environment");
394
if(not add_environment(getplugin(NULL), arg, true)){
395
perror("add_environment");
398
case 'o': /* --options-for */
365
399
if (arg != NULL){
366
400
char *p_name = strsep(&arg, ":");
367
if(p_name[0] == '\0'){
401
if(p_name[0] == '\0' or arg == NULL){
370
404
char *opt = strsep(&arg, ":");
405
if(opt[0] == '\0' or opt == NULL){
376
while((p = strsep(&opt, ",")) != NULL){
380
if(not add_argument(getplugin(p_name, plugins), p)){
381
perror("add_argument");
382
return ARGP_ERR_UNKNOWN;
409
while((p = strsep(&opt, ",")) != NULL){
413
if(not add_argument(getplugin(p_name), p)){
414
perror("add_argument");
415
return ARGP_ERR_UNKNOWN;
420
case 'E': /* --env-for */
394
426
if(envdef == NULL){
397
char *p_name = strndup(arg, (size_t) (envdef-arg));
402
if(not add_environment(getplugin(p_name, plugins), envdef)){
430
if(not add_environment(getplugin(arg), envdef+1, true)){
403
431
perror("add_environment");
435
case 'd': /* --disable */
408
436
if (arg != NULL){
409
plugin *p = getplugin(arg, plugins);
437
plugin *p = getplugin(arg);
411
439
return ARGP_ERR_UNKNOWN;
413
441
p->disabled = true;
444
case 'e': /* --enable */
446
plugin *p = getplugin(arg);
448
return ARGP_ERR_UNKNOWN;
453
case 128: /* --plugin-dir */
455
plugindir = strdup(arg);
456
if(plugindir == NULL){
460
case 129: /* --config-file */
461
/* This is already done by parse_opt_config_file() */
463
case 130: /* --userid */
420
464
uid = (uid_t)strtol(arg, NULL, 10);
466
case 131: /* --groupid */
423
467
gid = (gid_t)strtol(arg, NULL, 10);
469
case 132: /* --debug */
428
472
case ARGP_KEY_ARG:
429
fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);
434
return ARGP_ERR_UNKNOWN;
439
plugin *plugin_list = NULL;
441
struct argp argp = { .options = options, .parser = parse_opt,
442
.args_doc = "[+PLUS_SEPARATED_OPTIONS]",
473
/* Cryptsetup always passes an argument, which is an empty
474
string if "none" was specified in /etc/crypttab. So if
475
argument was empty, we ignore it silently. */
477
fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);
483
return ARGP_ERR_UNKNOWN;
488
/* This option parser is the same as parse_opt() above, except it
489
ignores everything but the --config-file option. */
490
error_t parse_opt_config_file (int key, char *arg,
491
__attribute__((unused))
492
struct argp_state *state) {
494
case 'g': /* --global-options */
495
case 'G': /* --global-env */
496
case 'o': /* --options-for */
497
case 'E': /* --env-for */
498
case 'd': /* --disable */
499
case 'e': /* --enable */
500
case 128: /* --plugin-dir */
502
case 129: /* --config-file */
504
argfile = strdup(arg);
509
case 130: /* --userid */
510
case 131: /* --groupid */
511
case 132: /* --debug */
516
return ARGP_ERR_UNKNOWN;
521
struct argp argp = { .options = options,
522
.parser = parse_opt_config_file,
443
524
.doc = "Mandos plugin runner -- Run plugins" };
445
ret = argp_parse (&argp, argc, argv, 0, 0, &plugin_list);
526
/* Parse using the parse_opt_config_file in order to get the custom
527
config file location, if any. */
528
ret = argp_parse (&argp, argc, argv, ARGP_IN_ORDER, 0, NULL);
446
529
if (ret == ARGP_ERR_UNKNOWN){
447
530
fprintf(stderr, "Unknown error while parsing arguments\n");
448
531
exitstatus = EXIT_FAILURE;
452
conffp = fopen(argfile, "r");
535
/* Reset to the normal argument parser */
536
argp.parser = parse_opt;
538
/* Open the configfile if available */
539
if (argfile == NULL){
540
conffp = fopen(AFILE, "r");
542
conffp = fopen(argfile, "r");
453
544
if(conffp != NULL){
454
545
char *org_line = NULL;
455
546
char *p, *arg, *new_arg, *line;
847
967
exitstatus = EXIT_FAILURE;
850
/* Delete this process entry from the list */
851
if(process_list == proc){
852
/* First one - simple */
853
process_list = proc->next;
855
/* Second one or later */
856
for(process *p = process_list; p != NULL; p = p->next){
858
p->next = proc->next;
971
plugin *next_plugin = proc->next;
863
975
/* We are done modifying process list, so unblock signal */
864
976
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask,
867
979
perror("sigprocmask");
871
/* We deleted this process from the list, so we can't go
872
proc->next. Therefore, start over from the beginning of
980
exitstatus = EXIT_FAILURE;
984
if(plugin_list == NULL){
876
991
/* This process exited nicely, so print its buffer */
878
993
bool bret = print_out_password(proc->buffer,
879
994
proc->buffer_length);
937
1061
perror("sigaction");
938
1062
exitstatus = EXIT_FAILURE;
941
1065
if(custom_argv != NULL){
942
1066
for(char **arg = custom_argv+1; *arg != NULL; arg++){
945
1069
free(custom_argv);
947
free_plugin_list(plugin_list);
949
1072
if(dir != NULL){
953
/* Free the process list and kill the processes */
954
for(process *next; process_list != NULL; process_list = next){
955
next = process_list->next;
956
close(process_list->fd);
957
ret = kill(process_list->pid, SIGTERM);
958
if(ret == -1 and errno != ESRCH){
959
/* set-uid proccesses migth not get closed */
1076
/* Kill the processes */
1077
for(plugin *p = plugin_list; p != NULL; p = p->next){
1080
ret = kill(p->pid, SIGTERM);
1081
if(ret == -1 and errno != ESRCH){
1082
/* Set-uid proccesses might not get closed */
962
free(process_list->buffer);
966
1088
/* Wait for any remaining child processes to terminate */