/mandos/trunk : revision 668

2

/*

3

* Mandos plugin runner - Run Mandos plugins

4

*

5

6

5

6

7

*

8

* This program is free software: you can redistribute it and/or

9

* modify it under the terms of the GNU General Public License as

23

*/

24

25

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), getline(),

26

O_CLOEXEC, pipe2() */

26

asprintf(), O_CLOEXEC */

27

#include <stddef.h> /* size_t, NULL */

28

#include <stdlib.h> /* malloc(), exit(), EXIT_SUCCESS,

29

realloc() */

30

#include <stdbool.h> /* bool, true, false */

31

#include <stdio.h> /* fileno(), fprintf(),

32

stderr, STDOUT_FILENO, fclose() */

33

#include <sys/types.h> /* fstat(), struct stat, waitpid(),

34

WIFEXITED(), WEXITSTATUS(), wait(),

35

pid_t, uid_t, gid_t, getuid(),

36

getgid() */

32

stderr, STDOUT_FILENO */

33

#include <sys/types.h> /* DIR, fdopendir(), stat(), struct

34

stat, waitpid(), WIFEXITED(),

35

WEXITSTATUS(), wait(), pid_t,

36

uid_t, gid_t, getuid(), getgid(),

37

dirfd() */

37

38

#include <sys/select.h> /* fd_set, select(), FD_ZERO(),

38

39

FD_SET(), FD_ISSET(), FD_CLR */

39

40

#include <sys/wait.h> /* wait(), waitpid(), WIFEXITED(),

40

41

WEXITSTATUS(), WTERMSIG(),

41

42

WCOREDUMP() */

42

#include <sys/stat.h> /* struct stat, fstat(), S_ISREG() */

43

#include <sys/stat.h> /* struct stat, stat(), S_ISREG() */

43

44

#include <iso646.h> /* and, or, not */

44

#include <dirent.h> /* struct dirent, scandirat() */

45

#include <unistd.h> /* fcntl(), F_GETFD, F_SETFD,

46

FD_CLOEXEC, write(), STDOUT_FILENO,

47

struct stat, fstat(), close(),

48

setgid(), setuid(), S_ISREG(),

49

faccessat() pipe2(), fork(),

50

_exit(), dup2(), fexecve(), read()

51

*/

45

#include <dirent.h> /* DIR, struct dirent, fdopendir(),

46

readdir(), closedir(), dirfd() */

47

#include <unistd.h> /* struct stat, stat(), S_ISREG(),

48

fcntl(), setuid(), setgid(),

49

F_GETFD, F_SETFD, FD_CLOEXEC,

50

access(), pipe(), fork(), close()

51

dup2(), STDOUT_FILENO, _exit(),

52

execv(), write(), read(),

53

close() */

52

54

#include <fcntl.h> /* fcntl(), F_GETFD, F_SETFD,

53

FD_CLOEXEC, openat(), scandirat(),

54

pipe2() */

55

#include <string.h> /* strsep, strlen(), strsignal(),

56

strcmp(), strncmp() */

55

FD_CLOEXEC */

56

#include <string.h> /* strsep, strlen(), asprintf(),

57

strsignal(), strcmp(), strncmp() */

57

58

#include <errno.h> /* errno */

58

59

#include <argp.h> /* struct argp_option, struct

59

60

argp_state, struct argp,

71

72

EX_CONFIG, EX_UNAVAILABLE, EX_OK */

72

73

#include <errno.h> /* errno */

73

74

#include <error.h> /* error() */

74

#include <fnmatch.h> /* fnmatch() */

75

76

#define BUFFER_SIZE 256

77

105

106

/* Gets an existing plugin based on name,

107

or if none is found, creates a new one */

108

__attribute__((warn_unused_result))

109

108

static plugin *getplugin(char *name){

110

109

/* Check for existing plugin with that name */

111

110

for(plugin *p = plugin_list; p != NULL; p = p->next){

172

171

}

173

172

174

173

/* Helper function for add_argument and add_environment */

175

__attribute__((nonnull, warn_unused_result))

174

__attribute__((nonnull))

176

175

static bool add_to_char_array(const char *new, char ***array,

177

176

int *len){

178

177

/* Resize the pointed-to array to hold one more pointer */

203

202

}

204

203

205

204

/* Add to a plugin's argument vector */

206

__attribute__((nonnull(2), warn_unused_result))

205

__attribute__((nonnull(2)))

207

206

static bool add_argument(plugin *p, const char *arg){

208

207

if(p == NULL){

209

208

return false;

212

211

}

213

212

214

213

/* Add to a plugin's environment */

215

__attribute__((nonnull(2), warn_unused_result))

214

__attribute__((nonnull(2)))

216

215

static bool add_environment(plugin *p, const char *def, bool replace){

217

216

if(p == NULL){

218

217

return false;

240

239

return add_to_char_array(def, &(p->environ), &(p->envc));

241

240

}

242

241

243

#ifndef O_CLOEXEC

244

242

/*

245

243

* Based on the example in the GNU LibC manual chapter 13.13 "File

246

244

* Descriptor Flags".

247

245

| [[info:libc:Descriptor%20Flags][File Descriptor Flags]] |

248

246

*/

249

__attribute__((warn_unused_result))

250

247

static int set_cloexec_flag(int fd){

251

248

int ret = (int)TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD, 0));

252

249

/* If reading the flags failed, return error indication now. */

257

254

return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,

258

255

ret | FD_CLOEXEC));

259

256

}

260

#endif /* not O_CLOEXEC */

261

257

262

258

263

259

/* Mark processes as completed when they exit, and save their exit

295

291

}

296

292

297

293

/* Prints out a password to stdout */

298

__attribute__((nonnull, warn_unused_result))

294

__attribute__((nonnull))

299

295

static bool print_out_password(const char *buffer, size_t length){

300

296

ssize_t ret;

301

297

for(size_t written = 0; written < length; written += (size_t)ret){

349

345

char *plugindir = NULL;

350

346

char *argfile = NULL;

351

347

FILE *conffp;

352

struct dirent **direntries;

348

size_t d_name_len;

349

DIR *dir = NULL;

350

struct dirent *dirst;

353

351

struct stat st;

354

352

fd_set rfds_all;

355

353

int ret, maxfd = 0;

363

361

.sa_flags = SA_NOCLDSTOP };

364

362

char **custom_argv = NULL;

365

363

int custom_argc = 0;

366

int dir_fd = -1;

367

364

368

365

/* Establish a signal handler */

369

366

sigemptyset(&sigchld_action.sa_mask);

440

437

break;

441

438

}

442

439

}

443

errno = 0;

444

440

}

445

441

break;

446

442

case 'G': /* --global-env */

447

if(add_environment(getplugin(NULL), arg, true)){

448

errno = 0;

449

}

443

add_environment(getplugin(NULL), arg, true);

450

444

break;

451

445

case 'o': /* --options-for */

452

446

{

469

463

break;

470

464

}

471

465

}

472

errno = 0;

473

466

}

474

467

break;

475

468

case 'E': /* --env-for */

487

480

errno = EINVAL;

488

481

break;

489

482

}

490

if(add_environment(getplugin(arg), envdef, true)){

491

errno = 0;

492

}

483

add_environment(getplugin(arg), envdef, true);

493

484

}

494

485

break;

495

486

case 'd': /* --disable */

497

488

plugin *p = getplugin(arg);

498

489

if(p != NULL){

499

490

p->disabled = true;

500

errno = 0;

501

491

}

502

492

}

503

493

break;

506

496

plugin *p = getplugin(arg);

507

497

if(p != NULL){

508

498

p->disabled = false;

509

errno = 0;

510

499

}

511

500

}

512

501

break;

513

502

case 128: /* --plugin-dir */

514

503

free(plugindir);

515

504

plugindir = strdup(arg);

516

if(plugindir != NULL){

517

errno = 0;

518

}

519

505

break;

520

506

case 129: /* --config-file */

521

507

/* This is already done by parse_opt_config_file() */

529

515

break;

530

516

}

531

517

uid = (uid_t)tmp_id;

532

errno = 0;

533

518

break;

534

519

case 131: /* --groupid */

535

520

tmp_id = strtoimax(arg, &tmp, 10);

540

525

break;

541

526

}

542

527

gid = (gid_t)tmp_id;

543

errno = 0;

544

528

break;

545

529

case 132: /* --debug */

546

530

debug = true;

594

578

case 129: /* --config-file */

595

579

free(argfile);

596

580

argfile = strdup(arg);

597

if(argfile != NULL){

598

errno = 0;

599

}

600

581

break;

601

582

case 130: /* --userid */

602

583

case 131: /* --groupid */

780

761

<http://bugs.debian.org/633582> */

781

762

int plugindir_fd = open(/* plugindir or */ PDIR, O_RDONLY);

782

763

if(plugindir_fd == -1){

783

if(errno != ENOENT){

784

error(0, errno, "open(\"" PDIR "\")");

785

}

764

error(0, errno, "open");

786

765

} else {

787

766

ret = (int)TEMP_FAILURE_RETRY(fstat(plugindir_fd, &st));

788

767

if(ret == -1){

811

790

812

791

/* Open plugin directory with close_on_exec flag */

813

792

{

814

dir_fd = open(plugindir != NULL ? plugindir : PDIR, O_RDONLY |

815

#ifdef O_CLOEXEC

816

O_CLOEXEC

817

#else /* not O_CLOEXEC */

818

0

819

#endif /* not O_CLOEXEC */

820

);

793

int dir_fd = -1;

794

if(plugindir == NULL){

795

dir_fd = open(PDIR, O_RDONLY |

796

#ifdef O_CLOEXEC

797

O_CLOEXEC

798

#else /* not O_CLOEXEC */

799

0

800

#endif /* not O_CLOEXEC */

801

);

802

} else {

803

dir_fd = open(plugindir, O_RDONLY |

804

#ifdef O_CLOEXEC

805

O_CLOEXEC

806

#else /* not O_CLOEXEC */

807

0

808

#endif /* not O_CLOEXEC */

809

);

810

}

821

811

if(dir_fd == -1){

822

812

error(0, errno, "Could not open plugin dir");

823

813

exitstatus = EX_UNAVAILABLE;

834

824

goto fallback;

835

825

}

836

826

#endif /* O_CLOEXEC */

837

}

838

839

int good_name(const struct dirent * const dirent){

840

const char * const patterns[] = { ".*", "#*#", "*~", "*.dpkg-new",

841

"*.dpkg-old", "*.dpkg-bak",

842

"*.dpkg-divert", NULL };

843

#ifdef __GNUC__

844

#pragma GCC diagnostic push

845

#pragma GCC diagnostic ignored "-Wcast-qual"

846

#endif

847

for(const char **pat = (const char **)patterns;

848

*pat != NULL; pat++){

849

#ifdef __GNUC__

850

#pragma GCC diagnostic pop

851

#endif

852

if(fnmatch(*pat, dirent->d_name, FNM_FILE_NAME | FNM_PERIOD)

853

!= FNM_NOMATCH){

854

if(debug){

855

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

856

" matching pattern %s\n", dirent->d_name, *pat);

857

}

858

return 0;

859

}

827

828

dir = fdopendir(dir_fd);

829

if(dir == NULL){

830

error(0, errno, "Could not open plugin dir");

831

TEMP_FAILURE_RETRY(close(dir_fd));

832

exitstatus = EX_OSERR;

833

goto fallback;

860

834

}

861

return 1;

862

}

863

864

#ifdef __GLIBC__

865

#if __GLIBC_PREREQ(2, 15)

866

int numplugins = scandirat(dir_fd, ".", &direntries, good_name,

867

alphasort);

868

#else /* not __GLIBC_PREREQ(2, 15) */

869

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

870

&direntries, good_name, alphasort);

871

#endif /* not __GLIBC_PREREQ(2, 15) */

872

#else /* not __GLIBC__ */

873

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

874

&direntries, good_name, alphasort);

875

#endif /* not __GLIBC__ */

876

if(numplugins == -1){

877

error(0, errno, "Could not scan plugin dir");

878

TEMP_FAILURE_RETRY(close(dir_fd));

879

exitstatus = EX_OSERR;

880

goto fallback;

881

835

}

882

836

883

837

FD_ZERO(&rfds_all);

884

838

885

839

/* Read and execute any executable in the plugin directory*/

886

for(int i = 0; i < numplugins; i++){

887

888

int plugin_fd = openat(dir_fd, direntries[i]->d_name, O_RDONLY);

889

if(plugin_fd == -1){

890

error(0, errno, "Could not open plugin");

840

while(true){

841

do {

842

dirst = readdir(dir);

843

} while(dirst == NULL and errno == EINTR);

844

845

/* All directory entries have been processed */

846

if(dirst == NULL){

847

if(errno == EBADF){

848

error(0, errno, "readdir");

849

exitstatus = EX_IOERR;

850

goto fallback;

851

}

852

break;

853

}

854

855

d_name_len = strlen(dirst->d_name);

856

857

/* Ignore dotfiles, backup files and other junk */

858

{

859

bool bad_name = false;

860

861

const char * const bad_prefixes[] = { ".", "#", NULL };

862

863

const char * const bad_suffixes[] = { "~", "#", ".dpkg-new",

864

".dpkg-old",

865

".dpkg-bak",

866

".dpkg-divert", NULL };

867

#ifdef __GNUC__

868

#pragma GCC diagnostic push

869

#pragma GCC diagnostic ignored "-Wcast-qual"

870

#endif

871

for(const char **pre = (const char **)bad_prefixes;

872

*pre != NULL; pre++){

873

#ifdef __GNUC__

874

#pragma GCC diagnostic pop

875

#endif

876

size_t pre_len = strlen(*pre);

877

if((d_name_len >= pre_len)

878

and strncmp((dirst->d_name), *pre, pre_len) == 0){

879

if(debug){

880

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

881

" with bad prefix %s\n", dirst->d_name, *pre);

882

}

883

bad_name = true;

884

break;

885

}

886

}

887

if(bad_name){

888

continue;

889

}

890

#ifdef __GNUC__

891

#pragma GCC diagnostic push

892

#pragma GCC diagnostic ignored "-Wcast-qual"

893

#endif

894

for(const char **suf = (const char **)bad_suffixes;

895

*suf != NULL; suf++){

896

#ifdef __GNUC__

897

#pragma GCC diagnostic pop

898

#endif

899

size_t suf_len = strlen(*suf);

900

if((d_name_len >= suf_len)

901

and (strcmp((dirst->d_name) + d_name_len-suf_len, *suf)

902

== 0)){

903

if(debug){

904

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

905

" with bad suffix %s\n", dirst->d_name, *suf);

906

}

907

bad_name = true;

908

break;

909

}

910

}

911

912

if(bad_name){

913

continue;

914

}

915

}

916

917

char *filename;

918

if(plugindir == NULL){

919

ret = (int)TEMP_FAILURE_RETRY(asprintf(&filename, PDIR "/%s",

920

dirst->d_name));

921

} else {

922

ret = (int)TEMP_FAILURE_RETRY(asprintf(&filename, "%s/%s",

923

plugindir,

924

dirst->d_name));

925

}

926

if(ret < 0){

927

error(0, errno, "asprintf");

891

928

continue;

892

929

}

893

ret = (int)TEMP_FAILURE_RETRY(fstat(plugin_fd, &st));

930

931

ret = (int)TEMP_FAILURE_RETRY(stat(filename, &st));

894

932

if(ret == -1){

895

933

error(0, errno, "stat");

896

TEMP_FAILURE_RETRY(close(plugin_fd));

934

free(filename);

897

935

continue;

898

936

}

899

937

900

938

/* Ignore non-executable files */

901

939

if(not S_ISREG(st.st_mode)

902

or (TEMP_FAILURE_RETRY(faccessat(dir_fd, direntries[i]->d_name,

903

X_OK, 0)) != 0)){

940

or (TEMP_FAILURE_RETRY(access(filename, X_OK)) != 0)){

904

941

if(debug){

905

fprintf(stderr, "Ignoring plugin dir entry \"%s/%s\""

906

" with bad type or mode\n",

907

plugindir != NULL ? plugindir : PDIR,

908

direntries[i]->d_name);

942

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

943

" with bad type or mode\n", filename);

909

944

}

910

TEMP_FAILURE_RETRY(close(plugin_fd));

945

free(filename);

911

946

continue;

912

947

}

913

948

914

plugin *p = getplugin(direntries[i]->d_name);

949

plugin *p = getplugin(dirst->d_name);

915

950

if(p == NULL){

916

951

error(0, errno, "getplugin");

917

TEMP_FAILURE_RETRY(close(plugin_fd));

952

free(filename);

918

953

continue;

919

954

}

920

955

if(p->disabled){

921

956

if(debug){

922

957

fprintf(stderr, "Ignoring disabled plugin \"%s\"\n",

923

direntries[i]->d_name);

958

dirst->d_name);

924

959

}

925

TEMP_FAILURE_RETRY(close(plugin_fd));

960

free(filename);

926

961

continue;

927

962

}

928

963

{

942

977

}

943

978

}

944

979

}

945

/* If this plugin has any environment variables, we need to

946

duplicate the environment from this process, too. */

980

/* If this plugin has any environment variables, we will call

981

using execve and need to duplicate the environment from this

982

process, too. */

947

983

if(p->environ[0] != NULL){

948

984

for(char **e = environ; *e != NULL; e++){

949

985

if(not add_environment(p, *e, false)){

953

989

}

954

990

955

991

int pipefd[2];

956

#ifndef O_CLOEXEC

957

992

ret = (int)TEMP_FAILURE_RETRY(pipe(pipefd));

958

#else /* O_CLOEXEC */

959

ret = (int)TEMP_FAILURE_RETRY(pipe2(pipefd, O_CLOEXEC));

960

#endif /* O_CLOEXEC */

961

993

if(ret == -1){

962

994

error(0, errno, "pipe");

963

995

exitstatus = EX_OSERR;

964

996

goto fallback;

965

997

}

966

if(pipefd[0] >= FD_SETSIZE){

967

fprintf(stderr, "pipe()[0] (%d) >= FD_SETSIZE (%d)", pipefd[0],

968

FD_SETSIZE);

969

TEMP_FAILURE_RETRY(close(pipefd[0]));

970

TEMP_FAILURE_RETRY(close(pipefd[1]));

971

exitstatus = EX_OSERR;

972

goto fallback;

973

}

974

#ifndef O_CLOEXEC

975

998

/* Ask OS to automatic close the pipe on exec */

976

999

ret = set_cloexec_flag(pipefd[0]);

977

1000

if(ret < 0){

978

1001

error(0, errno, "set_cloexec_flag");

979

TEMP_FAILURE_RETRY(close(pipefd[0]));

980

TEMP_FAILURE_RETRY(close(pipefd[1]));

981

1002

exitstatus = EX_OSERR;

982

1003

goto fallback;

983

1004

}

984

1005

ret = set_cloexec_flag(pipefd[1]);

985

1006

if(ret < 0){

986

1007

error(0, errno, "set_cloexec_flag");

987

TEMP_FAILURE_RETRY(close(pipefd[0]));

988

TEMP_FAILURE_RETRY(close(pipefd[1]));

989

1008

exitstatus = EX_OSERR;

990

1009

goto fallback;

991

1010

}

992

#endif /* not O_CLOEXEC */

993

1011

/* Block SIGCHLD until process is safely in process list */

994

1012

ret = (int)TEMP_FAILURE_RETRY(sigprocmask(SIG_BLOCK,

995

1013

&sigchld_action.sa_mask,

1006

1024

} while(pid == -1 and errno == EINTR);

1007

1025

if(pid == -1){

1008

1026

error(0, errno, "fork");

1009

TEMP_FAILURE_RETRY(sigprocmask(SIG_UNBLOCK,

1010

&sigchld_action.sa_mask, NULL));

1011

TEMP_FAILURE_RETRY(close(pipefd[0]));

1012

TEMP_FAILURE_RETRY(close(pipefd[1]));

1013

1027

exitstatus = EX_OSERR;

1014

1028

goto fallback;

1015

1029

}

1032

1046

_exit(EX_OSERR);

1033

1047

}

1034

1048

1035

if(fexecve(plugin_fd, p->argv,

1036

(p->environ[0] != NULL) ? p->environ : environ) < 0){

1037

error(0, errno, "fexecve for %s/%s",

1038

plugindir != NULL ? plugindir : PDIR,

1039

direntries[i]->d_name);

1040

_exit(EX_OSERR);

1049

if(dirfd(dir) < 0){

1050

/* If dir has no file descriptor, we could not set FD_CLOEXEC

1051

above and must now close it manually here. */

1052

closedir(dir);

1053

}

1054

if(p->environ[0] == NULL){

1055

if(execv(filename, p->argv) < 0){

1056

error(0, errno, "execv for %s", filename);

1057

_exit(EX_OSERR);

1058

}

1059

} else {

1060

if(execve(filename, p->argv, p->environ) < 0){

1061

error(0, errno, "execve for %s", filename);

1062

_exit(EX_OSERR);

1063

}

1041

1064

}

1042

1065

/* no return */

1043

1066

}

1044

1067

/* Parent process */

1045

1068

TEMP_FAILURE_RETRY(close(pipefd[1])); /* Close unused write end of

1046

1069

pipe */

1047

TEMP_FAILURE_RETRY(close(plugin_fd));

1048

plugin *new_plugin = getplugin(direntries[i]->d_name);

1070

free(filename);

1071

plugin *new_plugin = getplugin(dirst->d_name);

1049

1072

if(new_plugin == NULL){

1050

1073

error(0, errno, "getplugin");

1051

1074

ret = (int)(TEMP_FAILURE_RETRY

1092

1115

}

1093

1116

}

1094

1117

1095

TEMP_FAILURE_RETRY(close(dir_fd));

1118

TEMP_FAILURE_RETRY(closedir(dir));

1119

dir = NULL;

1096

1120

free_plugin(getplugin(NULL));

1097

1121

1098

1122

for(plugin *p = plugin_list; p != NULL; p = p->next){

1292

1316

free(custom_argv);

1293

1317

}

1294

1318

1295

if(dir_fd != -1){

1296

TEMP_FAILURE_RETRY(close(dir_fd));

1319

if(dir != NULL){

1320

closedir(dir);

1297

1321

}

1298

1322

1299

1323

/* Kill the processes */