/mandos/trunk : revision 702

23

*/

24

25

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), getline(),

26

O_CLOEXEC, pipe2() */

26

O_CLOEXEC */

27

#include <stddef.h> /* size_t, NULL */

28

#include <stdlib.h> /* malloc(), exit(), EXIT_SUCCESS,

29

realloc() */

30

#include <stdbool.h> /* bool, true, false */

31

#include <stdio.h> /* fileno(), fprintf(),

32

stderr, STDOUT_FILENO, fclose() */

33

#include <sys/types.h> /* fstat(), struct stat, waitpid(),

34

WIFEXITED(), WEXITSTATUS(), wait(),

35

pid_t, uid_t, gid_t, getuid(),

36

getgid() */

33

#include <sys/types.h> /* DIR, fdopendir(), fstat(), struct

34

stat, waitpid(), WIFEXITED(),

35

WEXITSTATUS(), wait(), pid_t,

36

uid_t, gid_t, getuid(), getgid(),

37

dirfd() */

37

38

#include <sys/select.h> /* fd_set, select(), FD_ZERO(),

38

39

FD_SET(), FD_ISSET(), FD_CLR */

39

40

#include <sys/wait.h> /* wait(), waitpid(), WIFEXITED(),

41

42

WCOREDUMP() */

42

43

#include <sys/stat.h> /* struct stat, fstat(), S_ISREG() */

43

44

#include <iso646.h> /* and, or, not */

44

#include <dirent.h> /* struct dirent, scandirat() */

45

#include <dirent.h> /* DIR, struct dirent, fdopendir(),

46

readdir(), closedir(), dirfd() */

45

47

#include <unistd.h> /* fcntl(), F_GETFD, F_SETFD,

46

48

FD_CLOEXEC, write(), STDOUT_FILENO,

47

49

struct stat, fstat(), close(),

48

50

setgid(), setuid(), S_ISREG(),

49

faccessat() pipe2(), fork(),

51

faccessat() pipe(), fork(),

50

52

_exit(), dup2(), fexecve(), read()

51

53

*/

52

54

#include <fcntl.h> /* fcntl(), F_GETFD, F_SETFD,

53

FD_CLOEXEC, openat(), scandirat(),

54

pipe2() */

55

FD_CLOEXEC, openat() */

55

56

#include <string.h> /* strsep, strlen(), strsignal(),

56

57

strcmp(), strncmp() */

57

58

#include <errno.h> /* errno */

76

77

#define BUFFER_SIZE 256

77

78

79

#define PDIR "/lib/mandos/plugins.d"

79

#define PHDIR "/lib/mandos/plugin-helpers"

80

#define AFILE "/conf/conf.d/mandos/plugin-runner.conf"

81

82

const char *argp_program_version = "plugin-runner " VERSION;

241

return add_to_char_array(def, &(p->environ), &(p->envc));

242

}

243

244

#ifndef O_CLOEXEC

245

244

/*

246

245

* Based on the example in the GNU LibC manual chapter 13.13 "File

247

246

* Descriptor Flags".

258

257

return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,

259

258

ret | FD_CLOEXEC));

260

259

}

261

#endif /* not O_CLOEXEC */

262

260

263

261

264

262

/* Mark processes as completed when they exit, and save their exit

348

346

349

347

int main(int argc, char *argv[]){

350

348

char *plugindir = NULL;

351

char *pluginhelperdir = NULL;

352

349

char *argfile = NULL;

353

350

FILE *conffp;

354

struct dirent **direntries = NULL;

351

DIR *dir = NULL;

352

struct dirent *dirst;

355

353

struct stat st;

356

354

fd_set rfds_all;

357

355

int ret, maxfd = 0;

365

363

.sa_flags = SA_NOCLDSTOP };

366

364

char **custom_argv = NULL;

367

365

int custom_argc = 0;

368

int dir_fd = -1;

366

int dir_fd;

369

367

370

368

/* Establish a signal handler */

371

369

sigemptyset(&sigchld_action.sa_mask);

416

414

.doc = "Group ID the plugins will run as", .group = 3 },

417

415

{ .name = "debug", .key = 132,

418

416

.doc = "Debug mode", .group = 4 },

419

{ .name = "plugin-helper-dir", .key = 133,

420

.arg = "DIRECTORY",

421

.doc = "Specify a different plugin helper directory",

422

.group = 2 },

423

417

/*

424

418

* These reproduce what we would get without ARGP_NO_HELP

425

419

*/

551

545

case 132: /* --debug */

552

546

debug = true;

553

547

break;

554

case 133: /* --plugin-helper-dir */

555

free(pluginhelperdir);

556

pluginhelperdir = strdup(arg);

557

if(pluginhelperdir != NULL){

558

errno = 0;

559

}

560

break;

561

548

/*

562

549

* These reproduce what we would get without ARGP_NO_HELP

563

550

*/

614

601

case 130: /* --userid */

615

602

case 131: /* --groupid */

616

603

case 132: /* --debug */

617

case 133: /* --plugin-helper-dir */

618

604

case '?': /* --help */

619

605

case -3: /* --usage */

620

606

case 'V': /* --version */

775

761

goto fallback;

776

762

}

777

763

778

{

779

char *pluginhelperenv;

780

bool bret = true;

781

ret = asprintf(&pluginhelperenv, "MANDOSPLUGINHELPERDIR=%s",

782

pluginhelperdir != NULL ? pluginhelperdir : PHDIR);

783

if(ret != -1){

784

bret = add_environment(getplugin(NULL), pluginhelperenv, true);

785

}

786

if(ret == -1 or not bret){

787

error(0, errno, "Failed to set MANDOSPLUGINHELPERDIR"

788

" environment variable to \"%s\" for all plugins\n",

789

pluginhelperdir != NULL ? pluginhelperdir : PHDIR);

790

}

791

if(ret != -1){

792

free(pluginhelperenv);

793

}

794

}

795

796

764

if(debug){

797

765

for(plugin *p = plugin_list; p != NULL; p=p->next){

798

766

fprintf(stderr, "Plugin: %s has %d arguments\n",

861

829

ret = set_cloexec_flag(dir_fd);

862

830

if(ret < 0){

863

831

error(0, errno, "set_cloexec_flag");

832

TEMP_FAILURE_RETRY(close(dir_fd));

864

833

exitstatus = EX_OSERR;

865

834

goto fallback;

866

835

}

867

836

#endif /* O_CLOEXEC */

837

838

dir = fdopendir(dir_fd);

839

if(dir == NULL){

840

error(0, errno, "Could not open plugin dir");

841

TEMP_FAILURE_RETRY(close(dir_fd));

842

exitstatus = EX_OSERR;

843

goto fallback;

844

}

868

845

}

869

846

870

int good_name(const struct dirent * const dirent){

871

const char * const patterns[] = { ".*", "#*#", "*~", "*.dpkg-new",

872

"*.dpkg-old", "*.dpkg-bak",

873

"*.dpkg-divert", NULL };

847

FD_ZERO(&rfds_all);

848

849

/* Read and execute any executable in the plugin directory*/

850

while(true){

851

do {

852

dirst = readdir(dir);

853

} while(dirst == NULL and errno == EINTR);

854

855

/* All directory entries have been processed */

856

if(dirst == NULL){

857

if(errno == EBADF){

858

error(0, errno, "readdir");

859

exitstatus = EX_IOERR;

860

goto fallback;

861

}

862

break;

863

}

864

865

/* Ignore dotfiles, backup files and other junk */

866

{

867

bool bad_name = false;

868

const char * const patterns[] = { ".*", "#*#", "*~",

869

"*.dpkg-new", "*.dpkg-old",

870

"*.dpkg-bak", "*.dpkg-divert",

871

NULL };

874

872

#ifdef __GNUC__

875

873

#pragma GCC diagnostic push

876

874

#pragma GCC diagnostic ignored "-Wcast-qual"

877

875

#endif

878

for(const char **pat = (const char **)patterns;

879

*pat != NULL; pat++){

876

for(const char **pat = (const char **)patterns;

877

*pat != NULL; pat++){

880

878

#ifdef __GNUC__

881

879

#pragma GCC diagnostic pop

882

880

#endif

883

if(fnmatch(*pat, dirent->d_name, FNM_FILE_NAME | FNM_PERIOD)

884

!= FNM_NOMATCH){

885

if(debug){

881

if(fnmatch(*pat, dirst->d_name,

882

FNM_FILE_NAME | FNM_PERIOD) != FNM_NOMATCH){

883

if(debug){

886

884

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

887

" matching pattern %s\n", dirent->d_name, *pat);

885

" matching pattern %s\n", dirst->d_name, *pat);

886

}

887

bad_name = true;

888

break;

888

889

}

889

return 0;

890

}

891

if(bad_name){

892

continue;

890

893

}

891

894

}

892

return 1;

893

}

894

895

#ifdef __GLIBC__

896

#if __GLIBC_PREREQ(2, 15)

897

int numplugins = scandirat(dir_fd, ".", &direntries, good_name,

898

alphasort);

899

#else /* not __GLIBC_PREREQ(2, 15) */

900

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

901

&direntries, good_name, alphasort);

902

#endif /* not __GLIBC_PREREQ(2, 15) */

903

#else /* not __GLIBC__ */

904

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

905

&direntries, good_name, alphasort);

906

#endif /* not __GLIBC__ */

907

if(numplugins == -1){

908

error(0, errno, "Could not scan plugin dir");

909

direntries = NULL;

910

exitstatus = EX_OSERR;

911

goto fallback;

912

}

913

914

FD_ZERO(&rfds_all);

915

916

/* Read and execute any executable in the plugin directory*/

917

for(int i = 0; i < numplugins; i++){

918

895

919

int plugin_fd = openat(dir_fd, direntries[i]->d_name, O_RDONLY);

896

int plugin_fd = openat(dir_fd, dirst->d_name, O_RDONLY |

897

#ifdef O_CLOEXEC

898

O_CLOEXEC

899

#else /* not O_CLOEXEC */

900

0

901

#endif /* not O_CLOEXEC */

902

);

920

903

if(plugin_fd == -1){

921

904

error(0, errno, "Could not open plugin");

922

free(direntries[i]);

923

continue;

924

}

905

continue;

906

}

907

#ifndef O_CLOEXEC

908

/* Set the FD_CLOEXEC flag on the plugin FD */

909

ret = set_cloexec_flag(plugin_fd);

910

if(ret < 0){

911

error(0, errno, "set_cloexec_flag");

912

TEMP_FAILURE_RETRY(close(plugin_fd));

913

continue;

914

}

915

#endif /* O_CLOEXEC */

925

916

ret = (int)TEMP_FAILURE_RETRY(fstat(plugin_fd, &st));

926

917

if(ret == -1){

927

918

error(0, errno, "stat");

928

919

TEMP_FAILURE_RETRY(close(plugin_fd));

929

free(direntries[i]);

930

920

continue;

931

921

}

932

922

933

923

/* Ignore non-executable files */

934

924

if(not S_ISREG(st.st_mode)

935

or (TEMP_FAILURE_RETRY(faccessat(dir_fd, direntries[i]->d_name,

936

X_OK, 0)) != 0)){

925

or (TEMP_FAILURE_RETRY(faccessat(dir_fd, dirst->d_name, X_OK,

926

0)) != 0)){

937

927

if(debug){

938

928

fprintf(stderr, "Ignoring plugin dir entry \"%s/%s\""

939

929

" with bad type or mode\n",

940

plugindir != NULL ? plugindir : PDIR,

941

direntries[i]->d_name);

930

plugindir != NULL ? plugindir : PDIR, dirst->d_name);

942

931

}

943

932

TEMP_FAILURE_RETRY(close(plugin_fd));

944

free(direntries[i]);

945

933

continue;

946

934

}

947

935

948

plugin *p = getplugin(direntries[i]->d_name);

936

plugin *p = getplugin(dirst->d_name);

949

937

if(p == NULL){

950

938

error(0, errno, "getplugin");

951

939

TEMP_FAILURE_RETRY(close(plugin_fd));

952

free(direntries[i]);

953

940

continue;

954

941

}

955

942

if(p->disabled){

956

943

if(debug){

957

944

fprintf(stderr, "Ignoring disabled plugin \"%s\"\n",

958

direntries[i]->d_name);

945

dirst->d_name);

959

946

}

960

947

TEMP_FAILURE_RETRY(close(plugin_fd));

961

free(direntries[i]);

962

948

continue;

963

949

}

964

950

{

989

975

}

990

976

991

977

int pipefd[2];

992

#ifndef O_CLOEXEC

993

978

ret = (int)TEMP_FAILURE_RETRY(pipe(pipefd));

994

#else /* O_CLOEXEC */

995

ret = (int)TEMP_FAILURE_RETRY(pipe2(pipefd, O_CLOEXEC));

996

#endif /* O_CLOEXEC */

997

979

if(ret == -1){

998

980

error(0, errno, "pipe");

999

981

exitstatus = EX_OSERR;

1000

free(direntries[i]);

1001

982

goto fallback;

1002

983

}

1003

984

if(pipefd[0] >= FD_SETSIZE){

1006

987

TEMP_FAILURE_RETRY(close(pipefd[0]));

1007

988

TEMP_FAILURE_RETRY(close(pipefd[1]));

1008

989

exitstatus = EX_OSERR;

1009

free(direntries[i]);

1010

990

goto fallback;

1011

991

}

1012

#ifndef O_CLOEXEC

1013

992

/* Ask OS to automatic close the pipe on exec */

1014

993

ret = set_cloexec_flag(pipefd[0]);

1015

994

if(ret < 0){

1017

996

TEMP_FAILURE_RETRY(close(pipefd[0]));

1018

997

TEMP_FAILURE_RETRY(close(pipefd[1]));

1019

998

exitstatus = EX_OSERR;

1020

free(direntries[i]);

1021

999

goto fallback;

1022

1000

}

1023

1001

ret = set_cloexec_flag(pipefd[1]);

1026

1004

TEMP_FAILURE_RETRY(close(pipefd[0]));

1027

1005

TEMP_FAILURE_RETRY(close(pipefd[1]));

1028

1006

exitstatus = EX_OSERR;

1029

free(direntries[i]);

1030

1007

goto fallback;

1031

1008

}

1032

#endif /* not O_CLOEXEC */

1033

1009

/* Block SIGCHLD until process is safely in process list */

1034

1010

ret = (int)TEMP_FAILURE_RETRY(sigprocmask(SIG_BLOCK,

1035

1011

&sigchld_action.sa_mask,

1037

1013

if(ret < 0){

1038

1014

error(0, errno, "sigprocmask");

1039

1015

exitstatus = EX_OSERR;

1040

free(direntries[i]);

1041

1016

goto fallback;

1042

1017

}

1043

1018

/* Starting a new process to be watched */

1052

1027

TEMP_FAILURE_RETRY(close(pipefd[0]));

1053

1028

TEMP_FAILURE_RETRY(close(pipefd[1]));

1054

1029

exitstatus = EX_OSERR;

1055

free(direntries[i]);

1056

1030

goto fallback;

1057

1031

}

1058

1032

if(pid == 0){

1074

1048

_exit(EX_OSERR);

1075

1049

}

1076

1050

1051

if(dirfd(dir) < 0){

1052

/* If dir has no file descriptor, we could not set FD_CLOEXEC

1053

above and must now close it manually here. */

1054

closedir(dir);

1055

}

1077

1056

if(fexecve(plugin_fd, p->argv,

1078

1057

(p->environ[0] != NULL) ? p->environ : environ) < 0){

1079

1058

error(0, errno, "fexecve for %s/%s",

1080

plugindir != NULL ? plugindir : PDIR,

1081

direntries[i]->d_name);

1059

plugindir != NULL ? plugindir : PDIR, dirst->d_name);

1082

1060

_exit(EX_OSERR);

1083

1061

}

1084

1062

/* no return */

1087

1065

TEMP_FAILURE_RETRY(close(pipefd[1])); /* Close unused write end of

1088

1066

pipe */

1089

1067

TEMP_FAILURE_RETRY(close(plugin_fd));

1090

plugin *new_plugin = getplugin(direntries[i]->d_name);

1068

plugin *new_plugin = getplugin(dirst->d_name);

1091

1069

if(new_plugin == NULL){

1092

1070

error(0, errno, "getplugin");

1093

1071

ret = (int)(TEMP_FAILURE_RETRY

1097

1075

error(0, errno, "sigprocmask");

1098

1076

}

1099

1077

exitstatus = EX_OSERR;

1100

free(direntries[i]);

1101

1078

goto fallback;

1102

1079

}

1103

free(direntries[i]);

1104

1080

1105

1081

new_plugin->pid = pid;

1106

1082

new_plugin->fd = pipefd[0];

1136

1112

}

1137

1113

}

1138

1114

1139

free(direntries);

1140

direntries = NULL;

1141

TEMP_FAILURE_RETRY(close(dir_fd));

1142

dir_fd = -1;

1115

TEMP_FAILURE_RETRY(closedir(dir));

1116

dir = NULL;

1143

1117

free_plugin(getplugin(NULL));

1144

1118

1145

1119

for(plugin *p = plugin_list; p != NULL; p = p->next){

1339

1313

free(custom_argv);

1340

1314

}

1341

1315

1342

free(direntries);

1343

1344

if(dir_fd != -1){

1345

TEMP_FAILURE_RETRY(close(dir_fd));

1316

if(dir != NULL){

1317

closedir(dir);

1346

1318

}

1347

1319

1348

1320

/* Kill the processes */

1368

1340

free_plugin_list();

1369

1341

1370

1342

free(plugindir);

1371

free(pluginhelperdir);

1372

1343

free(argfile);

1373

1344

1374

1345

return exitstatus;