/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.c

  • Committer: Teddy Hogeborn
  • Date: 2014-06-14 02:57:16 UTC
  • Revision ID: teddy@recompile.se-20140614025716-i6887rk3u1iy9l67
In plugin-runner, protect against a larger FD_SETSIZE than fd_set.

* plugin-runner.c (main): Before forking, check that the first FD from
                          pipe() does not exceed FD_SETSIZE.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.c
234
234
                          .af = af };
235
235
  if(new_server->ip == NULL){
236
236
    perror_plus("strdup");
237
 
    free(new_server);
238
237
    return false;
239
238
  }
240
239
  ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
240
  if(ret == -1){
242
241
    perror_plus("clock_gettime");
243
 
#ifdef __GNUC__
244
 
#pragma GCC diagnostic push
245
 
#pragma GCC diagnostic ignored "-Wcast-qual"
246
 
#endif
247
 
    free((char *)(new_server->ip));
248
 
#ifdef __GNUC__
249
 
#pragma GCC diagnostic pop
250
 
#endif
251
 
    free(new_server);
252
242
    return false;
253
243
  }
254
244
  /* Special case of first server */
1076
1066
     timed out */
1077
1067
  
1078
1068
  if(quit_now){
1079
 
    avahi_s_service_resolver_free(r);
1080
1069
    return;
1081
1070
  }
1082
1071
  
1469
1458
  error_t ret_errno = 0;
1470
1459
  if(seteuid(0) == -1){
1471
1460
    ret_errno = errno;
 
1461
    perror_plus("seteuid");
1472
1462
  }
1473
1463
  errno = old_errno;
1474
1464
  return ret_errno;
1485
1475
  }
1486
1476
  if(setuid(0) == -1){
1487
1477
    ret_errno = errno;
 
1478
    perror_plus("seteuid");
1488
1479
  }
1489
1480
  errno = old_errno;
1490
1481
  return ret_errno;
1497
1488
  error_t ret_errno = 0;
1498
1489
  if(seteuid(uid) == -1){
1499
1490
    ret_errno = errno;
 
1491
    perror_plus("seteuid");
1500
1492
  }
1501
1493
  errno = old_errno;
1502
1494
  return ret_errno;
1509
1501
  error_t ret_errno = 0;
1510
1502
  if(setuid(uid) == -1){
1511
1503
    ret_errno = errno;
 
1504
    perror_plus("setuid");
1512
1505
  }
1513
1506
  errno = old_errno;
1514
1507
  return ret_errno;
1517
1510
__attribute__((nonnull))
1518
1511
void run_network_hooks(const char *mode, const char *interface,
1519
1512
                       const float delay){
1520
 
  struct dirent **direntries = NULL;
 
1513
  struct dirent **direntries;
1521
1514
  if(hookdir_fd == -1){
1522
1515
    hookdir_fd = open(hookdir, O_RDONLY);
1523
1516
    if(hookdir_fd == -1){
1561
1554
    if(hook_pid == 0){
1562
1555
      /* Child */
1563
1556
      /* Raise privileges */
1564
 
      errno = raise_privileges_permanently();
1565
 
      if(errno != 0){
 
1557
      if(raise_privileges_permanently() != 0){
1566
1558
        perror_plus("Failed to raise privileges");
1567
1559
        _exit(EX_NOPERM);
1568
1560
      }
1650
1642
        _exit(EXIT_FAILURE);
1651
1643
      }
1652
1644
    } else {
1653
 
      if(hook_pid == -1){
1654
 
        perror_plus("fork");
1655
 
        free(direntry);
1656
 
        continue;
1657
 
      }
1658
1645
      int status;
1659
1646
      if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1660
1647
        perror_plus("waitpid");
1661
 
        free(direntry);
1662
1648
        continue;
1663
1649
      }
1664
1650
      if(WIFEXITED(status)){
1666
1652
          fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1667
1653
                       " with status %d\n", direntry->d_name,
1668
1654
                       WEXITSTATUS(status));
1669
 
          free(direntry);
1670
1655
          continue;
1671
1656
        }
1672
1657
      } else if(WIFSIGNALED(status)){
1673
1658
        fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1674
1659
                     " signal %d\n", direntry->d_name,
1675
1660
                     WTERMSIG(status));
1676
 
        free(direntry);
1677
1661
        continue;
1678
1662
      } else {
1679
1663
        fprintf_plus(stderr, "Warning: network hook \"%s\""
1680
1664
                     " crashed\n", direntry->d_name);
1681
 
        free(direntry);
1682
1665
        continue;
1683
1666
      }
1684
1667
    }
1686
1669
      fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
1670
                   direntry->d_name);
1688
1671
    }
1689
 
    free(direntry);
1690
1672
  }
1691
 
  free(direntries);
1692
1673
  if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1693
1674
    perror_plus("close");
1694
1675
  } else {
1751
1732
    /* Raise privileges */
1752
1733
    ret_errno = raise_privileges();
1753
1734
    if(ret_errno != 0){
1754
 
      errno = ret_errno;
1755
1735
      perror_plus("Failed to raise privileges");
1756
1736
    }
1757
1737
    
1861
1841
    /* Raise privileges */
1862
1842
    ret_errno = raise_privileges();
1863
1843
    if(ret_errno != 0){
1864
 
      errno = ret_errno;
1865
1844
      perror_plus("Failed to raise privileges");
1866
1845
    }
1867
1846
    
2286
2265
        if(ret_errno != 0){
2287
2266
          errno = ret_errno;
2288
2267
          perror_plus("argz_add");
2289
 
          free(direntries[i]);
2290
2268
          continue;
2291
2269
        }
2292
2270
        if(debug){
2293
2271
          fprintf_plus(stderr, "Will use interface \"%s\"\n",
2294
2272
                       direntries[i]->d_name);
2295
2273
        }
2296
 
        free(direntries[i]);
2297
2274
      }
2298
2275
      free(direntries);
2299
2276
    } else {
2300
 
      if(ret == 0){
2301
 
        free(direntries);
2302
 
      }
 
2277
      free(direntries);
2303
2278
      fprintf_plus(stderr, "Could not find a network interface\n");
2304
2279
      exitcode = EXIT_FAILURE;
2305
2280
      goto end;
2569
2544
    mc.current_server->prev->next = NULL;
2570
2545
    while(mc.current_server != NULL){
2571
2546
      server *next = mc.current_server->next;
2572
 
#ifdef __GNUC__
2573
 
#pragma GCC diagnostic push
2574
 
#pragma GCC diagnostic ignored "-Wcast-qual"
2575
 
#endif
2576
 
      free((char *)(mc.current_server->ip));
2577
 
#ifdef __GNUC__
2578
 
#pragma GCC diagnostic pop
2579
 
#endif
2580
2547
      free(mc.current_server);
2581
2548
      mc.current_server = next;
2582
2549
    }
2586
2553
  {
2587
2554
    ret_errno = raise_privileges();
2588
2555
    if(ret_errno != 0){
2589
 
      errno = ret_errno;
2590
2556
      perror_plus("Failed to raise privileges");
2591
2557
    } else {
2592
2558
      
2615
2581
    
2616
2582
    ret_errno = lower_privileges_permanently();
2617
2583
    if(ret_errno != 0){
2618
 
      errno = ret_errno;
2619
2584
      perror_plus("Failed to lower privileges permanently");
2620
2585
    }
2621
2586
  }
2643
2608
      int numentries = scandir(tempdir, &direntries, notdotentries,
2644
2609
                               alphasort);
2645
2610
#endif  /* not __GLIBC__ */
2646
 
      if(numentries >= 0){
 
2611
      if(numentries > 0){
2647
2612
        for(int i = 0; i < numentries; i++){
2648
2613
          ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2649
2614
          if(ret == -1){
2651
2616
                         " \"%s\", 0): %s\n", tempdir,
2652
2617
                         direntries[i]->d_name, strerror(errno));
2653
2618
          }
2654
 
          free(direntries[i]);
2655
2619
        }
2656
2620
        
2657
2621
        /* need to clean even if 0 because man page doesn't specify */