/mandos/release : revision 237.7.227

23

*/

24

25

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), getline(),

26

O_CLOEXEC, pipe2() */

26

O_CLOEXEC */

27

#include <stddef.h> /* size_t, NULL */

28

#include <stdlib.h> /* malloc(), exit(), EXIT_SUCCESS,

29

realloc() */

30

#include <stdbool.h> /* bool, true, false */

31

#include <stdio.h> /* fileno(), fprintf(),

32

stderr, STDOUT_FILENO, fclose() */

33

#include <sys/types.h> /* fstat(), struct stat, waitpid(),

34

WIFEXITED(), WEXITSTATUS(), wait(),

35

pid_t, uid_t, gid_t, getuid(),

36

getgid() */

33

#include <sys/types.h> /* DIR, fdopendir(), fstat(), struct

34

stat, waitpid(), WIFEXITED(),

35

WEXITSTATUS(), wait(), pid_t,

36

uid_t, gid_t, getuid(), getgid(),

37

dirfd() */

37

38

#include <sys/select.h> /* fd_set, select(), FD_ZERO(),

38

39

FD_SET(), FD_ISSET(), FD_CLR */

39

40

#include <sys/wait.h> /* wait(), waitpid(), WIFEXITED(),

41

42

WCOREDUMP() */

42

43

#include <sys/stat.h> /* struct stat, fstat(), S_ISREG() */

43

44

#include <iso646.h> /* and, or, not */

44

#include <dirent.h> /* struct dirent, scandirat() */

45

#include <dirent.h> /* DIR, struct dirent, fdopendir(),

46

readdir(), closedir(), dirfd() */

45

47

#include <unistd.h> /* fcntl(), F_GETFD, F_SETFD,

46

48

FD_CLOEXEC, write(), STDOUT_FILENO,

47

49

struct stat, fstat(), close(),

48

50

setgid(), setuid(), S_ISREG(),

49

faccessat() pipe2(), fork(),

51

faccessat() pipe(), fork(),

50

52

_exit(), dup2(), fexecve(), read()

51

53

*/

52

54

#include <fcntl.h> /* fcntl(), F_GETFD, F_SETFD,

53

FD_CLOEXEC, openat(), scandirat(),

54

pipe2() */

55

FD_CLOEXEC, openat() */

55

56

#include <string.h> /* strsep, strlen(), strsignal(),

56

57

strcmp(), strncmp() */

57

58

#include <errno.h> /* errno */

240

241

return add_to_char_array(def, &(p->environ), &(p->envc));

241

242

}

242

243

#ifndef O_CLOEXEC

244

/*

245

* Based on the example in the GNU LibC manual chapter 13.13 "File

246

* Descriptor Flags".

257

return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,

258

ret | FD_CLOEXEC));

259

}

260

#endif /* not O_CLOEXEC */

261

260

262

261

263

262

/* Mark processes as completed when they exit, and save their exit

349

348

char *plugindir = NULL;

350

349

char *argfile = NULL;

351

350

FILE *conffp;

352

struct dirent **direntries = NULL;

351

DIR *dir = NULL;

352

struct dirent *dirst;

353

struct stat st;

354

fd_set rfds_all;

355

int ret, maxfd = 0;

363

.sa_flags = SA_NOCLDSTOP };

364

char **custom_argv = NULL;

365

int custom_argc = 0;

366

int dir_fd = -1;

366

int dir_fd;

367

368

/* Establish a signal handler */

369

sigemptyset(&sigchld_action.sa_mask);

829

ret = set_cloexec_flag(dir_fd);

830

if(ret < 0){

831

error(0, errno, "set_cloexec_flag");

832

TEMP_FAILURE_RETRY(close(dir_fd));

832

833

exitstatus = EX_OSERR;

833

834

goto fallback;

834

835

}

835

836

#endif /* O_CLOEXEC */

837

838

dir = fdopendir(dir_fd);

839

if(dir == NULL){

840

error(0, errno, "Could not open plugin dir");

841

TEMP_FAILURE_RETRY(close(dir_fd));

842

exitstatus = EX_OSERR;

843

goto fallback;

844

}

836

845

}

837

846

838

int good_name(const struct dirent * const dirent){

839

const char * const patterns[] = { ".*", "#*#", "*~", "*.dpkg-new",

840

"*.dpkg-old", "*.dpkg-bak",

841

"*.dpkg-divert", NULL };

847

FD_ZERO(&rfds_all);

848

849

/* Read and execute any executable in the plugin directory*/

850

while(true){

851

do {

852

dirst = readdir(dir);

853

} while(dirst == NULL and errno == EINTR);

854

855

/* All directory entries have been processed */

856

if(dirst == NULL){

857

if(errno == EBADF){

858

error(0, errno, "readdir");

859

exitstatus = EX_IOERR;

860

goto fallback;

861

}

862

break;

863

}

864

865

/* Ignore dotfiles, backup files and other junk */

866

{

867

bool bad_name = false;

868

const char * const patterns[] = { ".*", "#*#", "*~",

869

"*.dpkg-new", "*.dpkg-old",

870

"*.dpkg-bak", "*.dpkg-divert",

871

NULL };

842

872

#ifdef __GNUC__

843

873

#pragma GCC diagnostic push

844

874

#pragma GCC diagnostic ignored "-Wcast-qual"

845

875

#endif

846

for(const char **pat = (const char **)patterns;

847

*pat != NULL; pat++){

876

for(const char **pat = (const char **)patterns;

877

*pat != NULL; pat++){

848

878

#ifdef __GNUC__

849

879

#pragma GCC diagnostic pop

850

880

#endif

851

if(fnmatch(*pat, dirent->d_name, FNM_FILE_NAME | FNM_PERIOD)

852

!= FNM_NOMATCH){

853

if(debug){

881

if(fnmatch(*pat, dirst->d_name,

882

FNM_FILE_NAME | FNM_PERIOD) != FNM_NOMATCH){

883

if(debug){

854

884

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

855

" matching pattern %s\n", dirent->d_name, *pat);

885

" matching pattern %s\n", dirst->d_name, *pat);

886

}

887

bad_name = true;

888

break;

856

889

}

857

return 0;

890

}

891

if(bad_name){

892

continue;

858

893

}

859

894

}

860

return 1;

861

}

862

863

#ifdef __GLIBC__

864

#if __GLIBC_PREREQ(2, 15)

865

int numplugins = scandirat(dir_fd, ".", &direntries, good_name,

866

alphasort);

867

#else /* not __GLIBC_PREREQ(2, 15) */

868

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

869

&direntries, good_name, alphasort);

870

#endif /* not __GLIBC_PREREQ(2, 15) */

871

#else /* not __GLIBC__ */

872

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

873

&direntries, good_name, alphasort);

874

#endif /* not __GLIBC__ */

875

if(numplugins == -1){

876

error(0, errno, "Could not scan plugin dir");

877

direntries = NULL;

878

exitstatus = EX_OSERR;

879

goto fallback;

880

}

881

882

FD_ZERO(&rfds_all);

883

884

/* Read and execute any executable in the plugin directory*/

885

for(int i = 0; i < numplugins; i++){

886

895

887

int plugin_fd = openat(dir_fd, direntries[i]->d_name, O_RDONLY);

896

int plugin_fd = openat(dir_fd, dirst->d_name, O_RDONLY |

897

#ifdef O_CLOEXEC

898

O_CLOEXEC

899

#else /* not O_CLOEXEC */

900

0

901

#endif /* not O_CLOEXEC */

902

);

888

903

if(plugin_fd == -1){

889

904

error(0, errno, "Could not open plugin");

890

free(direntries[i]);

891

continue;

892

}

905

continue;

906

}

907

#ifndef O_CLOEXEC

908

/* Set the FD_CLOEXEC flag on the plugin FD */

909

ret = set_cloexec_flag(plugin_fd);

910

if(ret < 0){

911

error(0, errno, "set_cloexec_flag");

912

TEMP_FAILURE_RETRY(close(plugin_fd));

913

continue;

914

}

915

#endif /* O_CLOEXEC */

893

916

ret = (int)TEMP_FAILURE_RETRY(fstat(plugin_fd, &st));

894

917

if(ret == -1){

895

918

error(0, errno, "stat");

896

919

TEMP_FAILURE_RETRY(close(plugin_fd));

897

free(direntries[i]);

898

920

continue;

899

921

}

900

922

901

923

/* Ignore non-executable files */

902

924

if(not S_ISREG(st.st_mode)

903

or (TEMP_FAILURE_RETRY(faccessat(dir_fd, direntries[i]->d_name,

904

X_OK, 0)) != 0)){

925

or (TEMP_FAILURE_RETRY(faccessat(dir_fd, dirst->d_name, X_OK,

926

0)) != 0)){

905

927

if(debug){

906

928

fprintf(stderr, "Ignoring plugin dir entry \"%s/%s\""

907

929

" with bad type or mode\n",

908

plugindir != NULL ? plugindir : PDIR,

909

direntries[i]->d_name);

930

plugindir != NULL ? plugindir : PDIR, dirst->d_name);

910

931

}

911

932

TEMP_FAILURE_RETRY(close(plugin_fd));

912

free(direntries[i]);

913

933

continue;

914

934

}

915

935

916

plugin *p = getplugin(direntries[i]->d_name);

936

plugin *p = getplugin(dirst->d_name);

917

937

if(p == NULL){

918

938

error(0, errno, "getplugin");

919

939

TEMP_FAILURE_RETRY(close(plugin_fd));

920

free(direntries[i]);

921

940

continue;

922

941

}

923

942

if(p->disabled){

924

943

if(debug){

925

944

fprintf(stderr, "Ignoring disabled plugin \"%s\"\n",

926

direntries[i]->d_name);

945

dirst->d_name);

927

946

}

928

947

TEMP_FAILURE_RETRY(close(plugin_fd));

929

free(direntries[i]);

930

948

continue;

931

949

}

932

950

{

957

975

}

958

976

959

977

int pipefd[2];

960

#ifndef O_CLOEXEC

961

978

ret = (int)TEMP_FAILURE_RETRY(pipe(pipefd));

962

#else /* O_CLOEXEC */

963

ret = (int)TEMP_FAILURE_RETRY(pipe2(pipefd, O_CLOEXEC));

964

#endif /* O_CLOEXEC */

965

979

if(ret == -1){

966

980

error(0, errno, "pipe");

967

981

exitstatus = EX_OSERR;

968

free(direntries[i]);

969

goto fallback;

970

}

971

if(pipefd[0] >= FD_SETSIZE){

972

fprintf(stderr, "pipe()[0] (%d) >= FD_SETSIZE (%d)", pipefd[0],

973

FD_SETSIZE);

974

TEMP_FAILURE_RETRY(close(pipefd[0]));

975

TEMP_FAILURE_RETRY(close(pipefd[1]));

976

exitstatus = EX_OSERR;

977

free(direntries[i]);

978

goto fallback;

979

}

980

#ifndef O_CLOEXEC

982

goto fallback;

983

}

981

984

/* Ask OS to automatic close the pipe on exec */

982

985

ret = set_cloexec_flag(pipefd[0]);

983

986

if(ret < 0){

984

987

error(0, errno, "set_cloexec_flag");

985

TEMP_FAILURE_RETRY(close(pipefd[0]));

986

TEMP_FAILURE_RETRY(close(pipefd[1]));

987

988

exitstatus = EX_OSERR;

988

free(direntries[i]);

989

goto fallback;

990

}

991

ret = set_cloexec_flag(pipefd[1]);

992

if(ret < 0){

993

error(0, errno, "set_cloexec_flag");

994

TEMP_FAILURE_RETRY(close(pipefd[0]));

995

TEMP_FAILURE_RETRY(close(pipefd[1]));

996

994

exitstatus = EX_OSERR;

997

free(direntries[i]);

998

995

goto fallback;

999

996

}

1000

#endif /* not O_CLOEXEC */

1001

997

/* Block SIGCHLD until process is safely in process list */

1002

998

ret = (int)TEMP_FAILURE_RETRY(sigprocmask(SIG_BLOCK,

1003

999

&sigchld_action.sa_mask,

1005

1001

if(ret < 0){

1006

1002

error(0, errno, "sigprocmask");

1007

1003

exitstatus = EX_OSERR;

1008

free(direntries[i]);

1009

1004

goto fallback;

1010

1005

}

1011

1006

/* Starting a new process to be watched */

1015

1010

} while(pid == -1 and errno == EINTR);

1016

1011

if(pid == -1){

1017

1012

error(0, errno, "fork");

1018

TEMP_FAILURE_RETRY(sigprocmask(SIG_UNBLOCK,

1019

&sigchld_action.sa_mask, NULL));

1020

TEMP_FAILURE_RETRY(close(pipefd[0]));

1021

TEMP_FAILURE_RETRY(close(pipefd[1]));

1022

1013

exitstatus = EX_OSERR;

1023

free(direntries[i]);

1024

1014

goto fallback;

1025

1015

}

1026

1016

if(pid == 0){

1042

1032

_exit(EX_OSERR);

1043

1033

}

1044

1034

1035

if(dirfd(dir) < 0){

1036

/* If dir has no file descriptor, we could not set FD_CLOEXEC

1037

above and must now close it manually here. */

1038

closedir(dir);

1039

}

1045

1040

if(fexecve(plugin_fd, p->argv,

1046

1041

(p->environ[0] != NULL) ? p->environ : environ) < 0){

1047

1042

error(0, errno, "fexecve for %s/%s",

1048

plugindir != NULL ? plugindir : PDIR,

1049

direntries[i]->d_name);

1043

plugindir != NULL ? plugindir : PDIR, dirst->d_name);

1050

1044

_exit(EX_OSERR);

1051

1045

}

1052

1046

/* no return */

1055

1049

TEMP_FAILURE_RETRY(close(pipefd[1])); /* Close unused write end of

1056

1050

pipe */

1057

1051

TEMP_FAILURE_RETRY(close(plugin_fd));

1058

plugin *new_plugin = getplugin(direntries[i]->d_name);

1052

plugin *new_plugin = getplugin(dirst->d_name);

1059

1053

if(new_plugin == NULL){

1060

1054

error(0, errno, "getplugin");

1061

1055

ret = (int)(TEMP_FAILURE_RETRY

1065

1059

error(0, errno, "sigprocmask");

1066

1060

}

1067

1061

exitstatus = EX_OSERR;

1068

free(direntries[i]);

1069

1062

goto fallback;

1070

1063

}

1071

free(direntries[i]);

1072

1064

1073

1065

new_plugin->pid = pid;

1074

1066

new_plugin->fd = pipefd[0];

1104

1096

}

1105

1097

}

1106

1098

1107

free(direntries);

1108

direntries = NULL;

1109

TEMP_FAILURE_RETRY(close(dir_fd));

1110

dir_fd = -1;

1099

TEMP_FAILURE_RETRY(closedir(dir));

1100

dir = NULL;

1111

1101

free_plugin(getplugin(NULL));

1112

1102

1113

1103

for(plugin *p = plugin_list; p != NULL; p = p->next){

1307

1297

free(custom_argv);

1308

1298

}

1309

1299

1310

free(direntries);

1311

1312

if(dir_fd != -1){

1313

TEMP_FAILURE_RETRY(close(dir_fd));

1300

if(dir != NULL){

1301

closedir(dir);

1314

1302

}

1315

1303

1316

1304

/* Kill the processes */