To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 691
- compare with another revision
- download diff
- download tarball
- view history from revision 691
- Committer: Teddy Hogeborn
- Date: 2014-06-07 21:58:56 UTC
- Revision ID: teddy@recompile.se-20140607215856-9q31dfsc68uuvzo4
Make mandos-client use scandirat() if it exists.
* plugins.d/mandos-client.d (hookdir_fd): File descriptor for hookdir.
(set_cloexec_flag): Define this function if O_CLOEXEC is undefined.
(run_network_hooks): Open hookdir_fd. Use scandirat() if it exists.
* plugins.d/mandos-client.d (hookdir_fd): File descriptor for hookdir.
(set_cloexec_flag): Define this function if O_CLOEXEC is undefined.
(run_network_hooks): Open hookdir_fd. Use scandirat() if it exists.
added
removed
plugins.d/mandos-client.c
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
35
#endif /* not _LARGEFILE_SOURCE */
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif
38
#endif /* not _FILE_OFFSET_BITS */
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
141
141
static const char sys_class_net[] = "/sys/class/net";
142
142
char *connect_to = NULL;
143
143
const char *hookdir = HOOKDIR;
144
int hookdir_fd = -1;
144
145
uid_t uid = 65534;
145
146
gid_t gid = 65534;
146
147
1335
1336
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1336
1337
"abcdefghijklmnopqrstuvwxyz"
1337
1338
"0123456789"
1338
"_-");
1339
"_.-");
1339
1340
if((direntry->d_name)[sret] != '\0'){
1340
1341
/* Contains non-allowed characters */
1341
1342
if(debug){
1359
1360
}
1360
1361
return 0;
1361
1362
}
1363
free(fullname);
1362
1364
if(not (S_ISREG(st.st_mode))){
1363
1365
/* Not a regular file */
1364
1366
if(debug){
1512
1514
return ret_errno;
1513
1515
}
1514
1516
1517
#ifndef O_CLOEXEC
1518
/*
1519
* Based on the example in the GNU LibC manual chapter 13.13 "File
1520
* Descriptor Flags".
1521
| [[info:libc:Descriptor%20Flags][File Descriptor Flags]] |
1522
*/
1523
__attribute__((warn_unused_result))
1524
static int set_cloexec_flag(int fd){
1525
int ret = (int)TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD, 0));
1526
/* If reading the flags failed, return error indication now. */
1527
if(ret < 0){
1528
return ret;
1529
}
1530
/* Store modified flag word in the descriptor. */
1531
return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,
1532
ret | FD_CLOEXEC));
1533
}
1534
#endif /* not O_CLOEXEC */
1535
1515
1536
__attribute__((nonnull))
1516
1537
void run_network_hooks(const char *mode, const char *interface,
1517
1538
const float delay){
1518
1539
struct dirent **direntries;
1519
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1520
alphasort);
1540
if(hookdir_fd == -1){
1541
hookdir_fd = open(hookdir, O_RDONLY |
1542
#ifdef O_CLOEXEC
1543
O_CLOEXEC
1544
#else /* not O_CLOEXEC */
1545
0
1546
#endif /* not O_CLOEXEC */
1547
);
1548
if(hookdir_fd == -1){
1549
if(errno == ENOENT){
1550
if(debug){
1551
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1552
" found\n", hookdir);
1553
}
1554
} else {
1555
perror_plus("open");
1556
}
1557
return;
1558
}
1559
#ifndef O_CLOEXEC
1560
if(set_cloexec_flag(hookdir_fd) < 0){
1561
perror_plus("set_cloexec_flag");
1562
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1563
perror_plus("close");
1564
} else {
1565
hookdir_fd = -1;
1566
}
1567
return;
1568
}
1569
#endif /* not O_CLOEXEC */
1570
}
1571
#ifdef __GLIBC__
1572
#if __GLIBC_PREREQ(2, 15)
1573
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1574
runnable_hook, alphasort);
1575
#else /* not __GLIBC_PREREQ(2, 15) */
1576
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1577
alphasort);
1578
#endif /* not __GLIBC_PREREQ(2, 15) */
1579
#else /* not __GLIBC__ */
1580
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1581
alphasort);
1582
#endif /* not __GLIBC__ */
1521
1583
if(numhooks == -1){
1522
if(errno == ENOENT){
1523
if(debug){
1524
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1525
" found\n", hookdir);
1526
}
1527
} else {
1528
perror_plus("scandir");
1529
}
1530
} else {
1531
struct dirent *direntry;
1532
int ret;
1533
int devnull = open("/dev/null", O_RDONLY);
1534
for(int i = 0; i < numhooks; i++){
1535
direntry = direntries[i];
1536
char *fullname = NULL;
1537
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1538
if(ret < 0){
1584
perror_plus("scandir");
1585
return;
1586
}
1587
struct dirent *direntry;
1588
int ret;
1589
int devnull = open("/dev/null", O_RDONLY);
1590
for(int i = 0; i < numhooks; i++){
1591
direntry = direntries[i];
1592
char *fullname = NULL;
1593
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1594
if(ret < 0){
1595
perror_plus("asprintf");
1596
continue;
1597
}
1598
if(debug){
1599
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1600
direntry->d_name);
1601
}
1602
pid_t hook_pid = fork();
1603
if(hook_pid == 0){
1604
/* Child */
1605
/* Raise privileges */
1606
if(raise_privileges_permanently() != 0){
1607
perror_plus("Failed to raise privileges");
1608
_exit(EX_NOPERM);
1609
}
1610
/* Set group */
1611
errno = 0;
1612
ret = setgid(0);
1613
if(ret == -1){
1614
perror_plus("setgid");
1615
_exit(EX_NOPERM);
1616
}
1617
/* Reset supplementary groups */
1618
errno = 0;
1619
ret = setgroups(0, NULL);
1620
if(ret == -1){
1621
perror_plus("setgroups");
1622
_exit(EX_NOPERM);
1623
}
1624
ret = dup2(devnull, STDIN_FILENO);
1625
if(ret == -1){
1626
perror_plus("dup2(devnull, STDIN_FILENO)");
1627
_exit(EX_OSERR);
1628
}
1629
ret = close(devnull);
1630
if(ret == -1){
1631
perror_plus("close");
1632
_exit(EX_OSERR);
1633
}
1634
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1635
if(ret == -1){
1636
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1637
_exit(EX_OSERR);
1638
}
1639
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1640
if(ret == -1){
1641
perror_plus("setenv");
1642
_exit(EX_OSERR);
1643
}
1644
ret = setenv("DEVICE", interface, 1);
1645
if(ret == -1){
1646
perror_plus("setenv");
1647
_exit(EX_OSERR);
1648
}
1649
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1650
if(ret == -1){
1651
perror_plus("setenv");
1652
_exit(EX_OSERR);
1653
}
1654
ret = setenv("MODE", mode, 1);
1655
if(ret == -1){
1656
perror_plus("setenv");
1657
_exit(EX_OSERR);
1658
}
1659
char *delaystring;
1660
ret = asprintf(&delaystring, "%f", (double)delay);
1661
if(ret == -1){
1539
1662
perror_plus("asprintf");
1540
continue;
1541
}
1542
if(debug){
1543
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1544
direntry->d_name);
1545
}
1546
pid_t hook_pid = fork();
1547
if(hook_pid == 0){
1548
/* Child */
1549
/* Raise privileges */
1550
if(raise_privileges_permanently() != 0){
1551
perror_plus("Failed to raise privileges");
1552
_exit(EX_NOPERM);
1553
}
1554
/* Set group */
1555
errno = 0;
1556
ret = setgid(0);
1557
if(ret == -1){
1558
perror_plus("setgid");
1559
_exit(EX_NOPERM);
1560
}
1561
/* Reset supplementary groups */
1562
errno = 0;
1563
ret = setgroups(0, NULL);
1564
if(ret == -1){
1565
perror_plus("setgroups");
1566
_exit(EX_NOPERM);
1567
}
1568
ret = dup2(devnull, STDIN_FILENO);
1569
if(ret == -1){
1570
perror_plus("dup2(devnull, STDIN_FILENO)");
1571
_exit(EX_OSERR);
1572
}
1573
ret = close(devnull);
1574
if(ret == -1){
1575
perror_plus("close");
1576
_exit(EX_OSERR);
1577
}
1578
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1579
if(ret == -1){
1580
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1581
_exit(EX_OSERR);
1582
}
1583
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1584
if(ret == -1){
1585
perror_plus("setenv");
1586
_exit(EX_OSERR);
1587
}
1588
ret = setenv("DEVICE", interface, 1);
1589
if(ret == -1){
1590
perror_plus("setenv");
1591
_exit(EX_OSERR);
1592
}
1593
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1594
if(ret == -1){
1595
perror_plus("setenv");
1596
_exit(EX_OSERR);
1597
}
1598
ret = setenv("MODE", mode, 1);
1599
if(ret == -1){
1600
perror_plus("setenv");
1601
_exit(EX_OSERR);
1602
}
1603
char *delaystring;
1604
ret = asprintf(&delaystring, "%f", (double)delay);
1605
if(ret == -1){
1606
perror_plus("asprintf");
1607
_exit(EX_OSERR);
1608
}
1609
ret = setenv("DELAY", delaystring, 1);
1610
if(ret == -1){
1611
free(delaystring);
1612
perror_plus("setenv");
1613
_exit(EX_OSERR);
1614
}
1663
_exit(EX_OSERR);
1664
}
1665
ret = setenv("DELAY", delaystring, 1);
1666
if(ret == -1){
1615
1667
free(delaystring);
1616
if(connect_to != NULL){
1617
ret = setenv("CONNECT", connect_to, 1);
1618
if(ret == -1){
1619
perror_plus("setenv");
1620
_exit(EX_OSERR);
1621
}
1622
}
1623
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1624
perror_plus("execl");
1625
_exit(EXIT_FAILURE);
1626
}
1668
perror_plus("setenv");
1669
_exit(EX_OSERR);
1670
}
1671
free(delaystring);
1672
if(connect_to != NULL){
1673
ret = setenv("CONNECT", connect_to, 1);
1674
if(ret == -1){
1675
perror_plus("setenv");
1676
_exit(EX_OSERR);
1677
}
1678
}
1679
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1680
perror_plus("execl");
1681
_exit(EXIT_FAILURE);
1682
}
1683
} else {
1684
int status;
1685
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1686
perror_plus("waitpid");
1687
free(fullname);
1688
continue;
1689
}
1690
if(WIFEXITED(status)){
1691
if(WEXITSTATUS(status) != 0){
1692
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1693
" with status %d\n", direntry->d_name,
1694
WEXITSTATUS(status));
1695
free(fullname);
1696
continue;
1697
}
1698
} else if(WIFSIGNALED(status)){
1699
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1700
" signal %d\n", direntry->d_name,
1701
WTERMSIG(status));
1702
free(fullname);
1703
continue;
1627
1704
} else {
1628
int status;
1629
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1630
perror_plus("waitpid");
1631
free(fullname);
1632
continue;
1633
}
1634
if(WIFEXITED(status)){
1635
if(WEXITSTATUS(status) != 0){
1636
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1637
" with status %d\n", direntry->d_name,
1638
WEXITSTATUS(status));
1639
free(fullname);
1640
continue;
1641
}
1642
} else if(WIFSIGNALED(status)){
1643
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1644
" signal %d\n", direntry->d_name,
1645
WTERMSIG(status));
1646
free(fullname);
1647
continue;
1648
} else {
1649
fprintf_plus(stderr, "Warning: network hook \"%s\""
1650
" crashed\n", direntry->d_name);
1651
free(fullname);
1652
continue;
1653
}
1654
}
1655
free(fullname);
1656
if(debug){
1657
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1658
direntry->d_name);
1659
}
1660
}
1661
close(devnull);
1662
}
1705
fprintf_plus(stderr, "Warning: network hook \"%s\""
1706
" crashed\n", direntry->d_name);
1707
free(fullname);
1708
continue;
1709
}
1710
}
1711
free(fullname);
1712
if(debug){
1713
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1714
direntry->d_name);
1715
}
1716
}
1717
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1718
perror_plus("close");
1719
} else {
1720
hookdir_fd = -1;
1721
}
1722
close(devnull);
1663
1723
}
1664
1724
1665
1725
__attribute__((nonnull, warn_unused_result))
2486
2546
if(debug){
2487
2547
fprintf_plus(stderr, "Starting Avahi loop search\n");
2488
2548
}
2489
2549
2490
2550
ret = avahi_loop_with_timeout(simple_poll,
2491
2551
(int)(retry_interval * 1000), &mc);
2492
2552
if(debug){
2596
2656
free(fullname);
2597
2657
}
2598
2658
}
2599
2659
2600
2660
/* need to clean even if 0 because man page doesn't specify */
2601
2661
free(direntries);
2602
2662
if(numentries == -1){
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0