3
3
* Mandos plugin runner - Run Mandos plugins
5
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
5
* Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
7
7
* This program is free software: you can redistribute it and/or
8
8
* modify it under the terms of the GNU General Public License as
27
27
#include <stdlib.h> /* malloc(), exit(), EXIT_FAILURE,
28
28
EXIT_SUCCESS, realloc() */
29
29
#include <stdbool.h> /* bool, true, false */
30
#include <stdio.h> /* perror, popen(), fileno(),
31
fprintf(), stderr, STDOUT_FILENO */
30
#include <stdio.h> /* perror, fileno(), fprintf(),
31
stderr, STDOUT_FILENO */
32
32
#include <sys/types.h> /* DIR, opendir(), stat(), struct
33
33
stat, waitpid(), WIFEXITED(),
34
34
WEXITSTATUS(), wait(), pid_t,
46
46
fcntl(), setuid(), setgid(),
47
47
F_GETFD, F_SETFD, FD_CLOEXEC,
48
48
access(), pipe(), fork(), close()
49
dup2, STDOUT_FILENO, _exit(),
49
dup2(), STDOUT_FILENO, _exit(),
50
50
execv(), write(), read(),
52
52
#include <fcntl.h> /* fcntl(), F_GETFD, F_SETFD,
69
69
#define PDIR "/lib/mandos/plugins.d"
70
70
#define AFILE "/conf/conf.d/mandos/plugin-runner.conf"
72
const char *argp_program_version = "plugin-runner 1.0";
72
const char *argp_program_version = "plugin-runner " VERSION;
73
73
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
77
75
typedef struct plugin{
78
76
char *name; /* can be NULL or any plugin name */
97
95
static plugin *plugin_list = NULL;
99
/* Gets a existing plugin based on name,
97
/* Gets an existing plugin based on name,
100
98
or if none is found, creates a new one */
101
99
static plugin *getplugin(char *name){
102
100
/* Check for exiting plugin with that name */
187
185
size_t namelen = (size_t)(strchrnul(def, '=') - def);
188
186
/* Search for this environment variable */
189
187
for(char **e = p->environ; *e != NULL; e++){
190
if(strncmp(*e, def, namelen+1) == 0){
188
if(strncmp(*e, def, namelen + 1) == 0){
191
189
/* It already exists */
193
char *new = realloc(*e, strlen(def));
191
char *new = realloc(*e, strlen(def) + 1);
208
206
* Descriptor Flags".
209
207
* *Note File Descriptor Flags:(libc)Descriptor Flags.
211
static int set_cloexec_flag(int fd)
209
static int set_cloexec_flag(int fd){
213
210
int ret = fcntl(fd, F_GETFD, 0);
214
211
/* If reading the flags failed, return error indication now. */
223
220
/* Mark processes as completed when they exit, and save their exit
225
void handle_sigchld(__attribute__((unused)) int sig){
222
static void handle_sigchld(__attribute__((unused)) int sig){
227
224
plugin *proc = plugin_list;
255
252
/* Prints out a password to stdout */
256
bool print_out_password(const char *buffer, size_t length){
253
static bool print_out_password(const char *buffer, size_t length){
258
if(length>0 and buffer[length-1] == '\n'){
261
255
for(size_t written = 0; written < length; written += (size_t)ret){
262
256
ret = TEMP_FAILURE_RETRY(write(STDOUT_FILENO, buffer + written,
263
257
length - written));
344
338
{ .name = "global-options", .key = 'g',
345
339
.arg = "OPTION[,OPTION[,...]]",
346
340
.doc = "Options passed to all plugins" },
347
{ .name = "global-env", .key = 'e',
341
{ .name = "global-env", .key = 'G',
348
342
.arg = "VAR=value",
349
343
.doc = "Environment variable passed to all plugins" },
350
344
{ .name = "options-for", .key = 'o',
351
345
.arg = "PLUGIN:OPTION[,OPTION[,...]]",
352
346
.doc = "Options passed only to specified plugin" },
353
{ .name = "env-for", .key = 'f',
347
{ .name = "env-for", .key = 'E',
354
348
.arg = "PLUGIN:ENV=value",
355
349
.doc = "Environment variable passed to specified plugin" },
356
350
{ .name = "disable", .key = 'd',
358
352
.doc = "Disable a specific plugin", .group = 1 },
353
{ .name = "enable", .key = 'e',
355
.doc = "Enable a specific plugin", .group = 1 },
359
356
{ .name = "plugin-dir", .key = 128,
360
357
.arg = "DIRECTORY",
361
358
.doc = "Specify a different plugin directory", .group = 2 },
393
case 'e': /* --global-env */
390
case 'G': /* --global-env */
398
char *envdef = strdup(arg);
402
if(not add_environment(getplugin(NULL), envdef, true)){
403
perror("add_environment");
394
if(not add_environment(getplugin(NULL), arg, true)){
395
perror("add_environment");
407
398
case 'o': /* --options-for */
408
399
if (arg != NULL){
409
400
char *p_name = strsep(&arg, ":");
410
if(p_name[0] == '\0'){
401
if(p_name[0] == '\0' or arg == NULL){
413
404
char *opt = strsep(&arg, ":");
405
if(opt[0] == '\0' or opt == NULL){
419
while((p = strsep(&opt, ",")) != NULL){
423
if(not add_argument(getplugin(p_name), p)){
424
perror("add_argument");
425
return ARGP_ERR_UNKNOWN;
409
while((p = strsep(&opt, ",")) != NULL){
413
if(not add_argument(getplugin(p_name), p)){
414
perror("add_argument");
415
return ARGP_ERR_UNKNOWN;
431
case 'f': /* --env-for */
420
case 'E': /* --env-for */
437
426
if(envdef == NULL){
440
char *p_name = strndup(arg, (size_t) (envdef-arg));
445
if(not add_environment(getplugin(p_name), envdef, true)){
430
if(not add_environment(getplugin(arg), envdef+1, true)){
446
431
perror("add_environment");
477
472
case ARGP_KEY_ARG:
478
fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);
473
/* Cryptsetup always passes an argument, which is an empty
474
string if "none" was specified in /etc/crypttab. So if
475
argument was empty, we ignore it silently. */
477
fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);
480
480
case ARGP_KEY_END:
492
492
struct argp_state *state) {
494
494
case 'g': /* --global-options */
495
case 'e': /* --global-env */
495
case 'G': /* --global-env */
496
496
case 'o': /* --options-for */
497
case 'f': /* --env-for */
497
case 'E': /* --env-for */
498
498
case 'd': /* --disable */
499
case 'e': /* --enable */
499
500
case 128: /* --plugin-dir */
501
502
case 129: /* --config-file */
502
504
argfile = strdup(arg);
503
505
if(argfile == NULL){
504
506
perror("strdup");
737
ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name);
739
if(plugindir == NULL){
740
ret = asprintf(&filename, PDIR "/%s", dirst->d_name);
742
ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name);
739
745
perror("asprintf");
840
846
perror("sigaction");
841
847
_exit(EXIT_FAILURE);
843
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask, NULL);
849
ret = sigprocmask(SIG_UNBLOCK, &sigchld_action.sa_mask, NULL);
845
851
perror("sigprocmask");
846
852
_exit(EXIT_FAILURE);
849
855
ret = dup2(pipefd[1], STDOUT_FILENO); /* replace our stdout */
930
935
/* OK, now either a process completed, or something can be read
931
936
from one of them */
932
for(plugin *proc = plugin_list; proc != NULL; proc = proc->next){
937
for(plugin *proc = plugin_list; proc != NULL;){
933
938
/* Is this process completely done? */
934
939
if(proc->eof and proc->completed){
935
940
/* Only accept the plugin output if it exited cleanly */
962
967
exitstatus = EXIT_FAILURE;
971
plugin *next_plugin = proc->next;
965
972
free_plugin(proc);
966
975
/* We are done modifying process list, so unblock signal */
967
976
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask,
992
1002
/* This process has not completed. Does it have any output? */
993
1003
if(proc->eof or not FD_ISSET(proc->fd, &rfds)){
994
1004
/* This process had nothing to say at this time */
997
1008
/* Before reading, make the process' data buffer large enough */
1031
1043
fprintf(stderr, "Going to fallback mode using getpass(3)\n");
1032
1044
char *passwordbuffer = getpass("Password: ");
1033
bret = print_out_password(passwordbuffer, strlen(passwordbuffer));
1045
size_t len = strlen(passwordbuffer);
1046
/* Strip trailing newline */
1047
if(len > 0 and passwordbuffer[len-1] == '\n'){
1048
passwordbuffer[len-1] = '\0'; /* not strictly necessary */
1051
bret = print_out_password(passwordbuffer, len);
1035
1053
perror("print_out_password");
1036
1054
exitstatus = EXIT_FAILURE;
added
removed
plugin-runner.c
