3
3
* Mandos plugin runner - Run Mandos plugins
5
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
5
* Copyright © 2008,2009 Teddy Hogeborn
6
* Copyright © 2008,2009 Björn Påhlsson
7
8
* This program is free software: you can redistribute it and/or
8
9
* modify it under the terms of the GNU General Public License as
27
28
#include <stdlib.h> /* malloc(), exit(), EXIT_FAILURE,
28
29
EXIT_SUCCESS, realloc() */
29
30
#include <stdbool.h> /* bool, true, false */
30
#include <stdio.h> /* perror, popen(), fileno(),
31
fprintf(), stderr, STDOUT_FILENO */
31
#include <stdio.h> /* perror, fileno(), fprintf(),
32
stderr, STDOUT_FILENO */
32
33
#include <sys/types.h> /* DIR, opendir(), stat(), struct
33
34
stat, waitpid(), WIFEXITED(),
34
35
WEXITSTATUS(), wait(), pid_t,
46
47
fcntl(), setuid(), setgid(),
47
48
F_GETFD, F_SETFD, FD_CLOEXEC,
48
49
access(), pipe(), fork(), close()
49
dup2, STDOUT_FILENO, _exit(),
50
dup2(), STDOUT_FILENO, _exit(),
50
51
execv(), write(), read(),
52
53
#include <fcntl.h> /* fcntl(), F_GETFD, F_SETFD,
69
70
#define PDIR "/lib/mandos/plugins.d"
70
71
#define AFILE "/conf/conf.d/mandos/plugin-runner.conf"
72
const char *argp_program_version = "plugin-runner 1.0";
73
const char *argp_program_version = "plugin-runner " VERSION;
73
74
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
77
76
typedef struct plugin{
78
77
char *name; /* can be NULL or any plugin name */
208
207
* Descriptor Flags".
209
208
* *Note File Descriptor Flags:(libc)Descriptor Flags.
211
static int set_cloexec_flag(int fd)
210
static int set_cloexec_flag(int fd){
213
211
int ret = fcntl(fd, F_GETFD, 0);
214
212
/* If reading the flags failed, return error indication now. */
223
221
/* Mark processes as completed when they exit, and save their exit
225
void handle_sigchld(__attribute__((unused)) int sig){
223
static void handle_sigchld(__attribute__((unused)) int sig){
227
225
plugin *proc = plugin_list;
255
253
/* Prints out a password to stdout */
256
bool print_out_password(const char *buffer, size_t length){
254
static bool print_out_password(const char *buffer, size_t length){
258
256
for(size_t written = 0; written < length; written += (size_t)ret){
259
257
ret = TEMP_FAILURE_RETRY(write(STDOUT_FILENO, buffer + written,
398
char *envdef = strdup(arg);
402
if(not add_environment(getplugin(NULL), envdef, true)){
403
perror("add_environment");
396
if(not add_environment(getplugin(NULL), arg, true)){
397
perror("add_environment");
407
400
case 'o': /* --options-for */
435
428
if(envdef == NULL){
438
char *p_name = strndup(arg, (size_t) (envdef-arg));
443
if(not add_environment(getplugin(p_name), envdef, true)){
432
if(not add_environment(getplugin(arg), envdef+1, true)){
444
433
perror("add_environment");
473
463
/* This is already done by parse_opt_config_file() */
475
465
case 130: /* --userid */
476
uid = (uid_t)strtol(arg, NULL, 10);
466
/* In the GNU C library, uid_t is always unsigned int */
467
ret = sscanf(arg, "%ud", &uid);
469
fprintf(stderr, "Bad user ID number: \"%s\", using %ud\n",
478
473
case 131: /* --groupid */
479
gid = (gid_t)strtol(arg, NULL, 10);
474
/* In the GNU C library, gid_t is always unsigned int */
475
ret = sscanf(arg, "%ud", &gid);
477
fprintf(stderr, "Bad group ID number: \"%s\", using %ud\n",
481
481
case 132: /* --debug */
485
* When adding more options before this line, remember to also add a
486
* "case" to the "parse_opt_config_file" function below.
484
488
case ARGP_KEY_ARG:
485
fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);
489
/* Cryptsetup always passes an argument, which is an empty
490
string if "none" was specified in /etc/crypttab. So if
491
argument was empty, we ignore it silently. */
493
fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);
487
496
case ARGP_KEY_END:
551
561
char *org_line = NULL;
552
562
char *p, *arg, *new_arg, *line;
555
564
const char whitespace_delims[] = " \r\t\f\v\n";
556
565
const char comment_delim[] = "#";
707
716
const char const *bad_suffixes[] = { "~", "#", ".dpkg-new",
709
719
".dpkg-divert", NULL };
710
720
for(const char **pre = bad_prefixes; *pre != NULL; pre++){
711
721
size_t pre_len = strlen(*pre);
745
ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name);
755
if(plugindir == NULL){
756
ret = asprintf(&filename, PDIR "/%s", dirst->d_name);
758
ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name);
747
761
perror("asprintf");
848
862
perror("sigaction");
849
863
_exit(EXIT_FAILURE);
851
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask, NULL);
865
ret = sigprocmask(SIG_UNBLOCK, &sigchld_action.sa_mask, NULL);
853
867
perror("sigprocmask");
854
868
_exit(EXIT_FAILURE);
857
871
ret = dup2(pipefd[1], STDOUT_FILENO); /* replace our stdout */
938
951
/* OK, now either a process completed, or something can be read
939
952
from one of them */
940
for(plugin *proc = plugin_list; proc != NULL; proc = proc->next){
953
for(plugin *proc = plugin_list; proc != NULL;){
941
954
/* Is this process completely done? */
942
955
if(proc->eof and proc->completed){
943
956
/* Only accept the plugin output if it exited cleanly */
970
983
exitstatus = EXIT_FAILURE;
987
plugin *next_plugin = proc->next;
973
988
free_plugin(proc);
974
991
/* We are done modifying process list, so unblock signal */
975
992
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask,
1000
1018
/* This process has not completed. Does it have any output? */
1001
1019
if(proc->eof or not FD_ISSET(proc->fd, &rfds)){
1002
1020
/* This process had nothing to say at this time */
1005
1024
/* Before reading, make the process' data buffer large enough */
1014
1033
proc->buffer_size += BUFFER_SIZE;
1016
1035
/* Read from the process */
1017
ret = read(proc->fd, proc->buffer + proc->buffer_length,
1036
sret = read(proc->fd, proc->buffer + proc->buffer_length,
1020
1039
/* Read error from this process; ignore the error */
1025
1045
proc->eof = true;
1027
proc->buffer_length += (size_t) ret;
1047
proc->buffer_length += (size_t) sret;
added
removed
plugin-runner.c
