/mandos/trunk : revision 712

2

/*

3

* Mandos plugin runner - Run Mandos plugins

4

*

5

6

5

6

7

*

8

* This program is free software: you can redistribute it and/or

9

* modify it under the terms of the GNU General Public License as

23

*/

24

25

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), getline(),

26

asprintf(), O_CLOEXEC */

26

O_CLOEXEC, pipe2() */

27

#include <stddef.h> /* size_t, NULL */

28

#include <stdlib.h> /* malloc(), exit(), EXIT_SUCCESS,

29

realloc() */

30

#include <stdbool.h> /* bool, true, false */

31

#include <stdio.h> /* fileno(), fprintf(),

32

stderr, STDOUT_FILENO */

33

#include <sys/types.h> /* DIR, fdopendir(), stat(), struct

34

stat, waitpid(), WIFEXITED(),

35

WEXITSTATUS(), wait(), pid_t,

36

uid_t, gid_t, getuid(), getgid(),

37

dirfd() */

32

stderr, STDOUT_FILENO, fclose() */

33

#include <sys/types.h> /* fstat(), struct stat, waitpid(),

34

WIFEXITED(), WEXITSTATUS(), wait(),

35

pid_t, uid_t, gid_t, getuid(),

36

getgid() */

38

37

#include <sys/select.h> /* fd_set, select(), FD_ZERO(),

39

38

FD_SET(), FD_ISSET(), FD_CLR */

40

39

#include <sys/wait.h> /* wait(), waitpid(), WIFEXITED(),

41

40

WEXITSTATUS(), WTERMSIG(),

42

41

WCOREDUMP() */

43

#include <sys/stat.h> /* struct stat, stat(), S_ISREG() */

42

#include <sys/stat.h> /* struct stat, fstat(), S_ISREG() */

44

43

#include <iso646.h> /* and, or, not */

45

#include <dirent.h> /* DIR, struct dirent, fdopendir(),

46

readdir(), closedir(), dirfd() */

47

#include <unistd.h> /* struct stat, stat(), S_ISREG(),

48

fcntl(), setuid(), setgid(),

49

F_GETFD, F_SETFD, FD_CLOEXEC,

50

access(), pipe(), fork(), close()

51

dup2(), STDOUT_FILENO, _exit(),

52

execve(), write(), read(),

53

close() */

44

#include <dirent.h> /* struct dirent, scandirat() */

45

#include <unistd.h> /* fcntl(), F_GETFD, F_SETFD,

46

FD_CLOEXEC, write(), STDOUT_FILENO,

47

struct stat, fstat(), close(),

48

setgid(), setuid(), S_ISREG(),

49

faccessat() pipe2(), fork(),

50

_exit(), dup2(), fexecve(), read()

51

*/

54

52

#include <fcntl.h> /* fcntl(), F_GETFD, F_SETFD,

55

FD_CLOEXEC */

56

#include <string.h> /* strsep, strlen(), asprintf(),

57

strsignal(), strcmp(), strncmp() */

53

FD_CLOEXEC, openat(), scandirat(),

54

pipe2() */

55

#include <string.h> /* strsep, strlen(), strsignal(),

56

strcmp(), strncmp() */

58

57

#include <errno.h> /* errno */

59

58

#include <argp.h> /* struct argp_option, struct

60

59

argp_state, struct argp,

72

71

EX_CONFIG, EX_UNAVAILABLE, EX_OK */

73

72

#include <errno.h> /* errno */

74

73

#include <error.h> /* error() */

74

#include <fnmatch.h> /* fnmatch() */

75

76

#define BUFFER_SIZE 256

77

240

return add_to_char_array(def, &(p->environ), &(p->envc));

241

}

242

243

#ifndef O_CLOEXEC

243

244

/*

244

245

* Based on the example in the GNU LibC manual chapter 13.13 "File

245

246

* Descriptor Flags".

256

257

return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,

257

258

ret | FD_CLOEXEC));

258

259

}

260

#endif /* not O_CLOEXEC */

259

261

260

262

261

263

/* Mark processes as completed when they exit, and save their exit

347

349

char *plugindir = NULL;

348

350

char *argfile = NULL;

349

351

FILE *conffp;

350

size_t d_name_len;

351

DIR *dir = NULL;

352

struct dirent *dirst;

352

struct dirent **direntries = NULL;

353

struct stat st;

354

fd_set rfds_all;

355

int ret, maxfd = 0;

363

.sa_flags = SA_NOCLDSTOP };

364

char **custom_argv = NULL;

365

int custom_argc = 0;

366

int dir_fd = -1;

366

367

368

/* Establish a signal handler */

368

369

sigemptyset(&sigchld_action.sa_mask);

779

780

<http://bugs.debian.org/633582> */

780

781

int plugindir_fd = open(/* plugindir or */ PDIR, O_RDONLY);

781

782

if(plugindir_fd == -1){

782

error(0, errno, "open(\"" PDIR "\")");

783

if(errno != ENOENT){

784

error(0, errno, "open(\"" PDIR "\")");

785

}

783

786

} else {

784

787

ret = (int)TEMP_FAILURE_RETRY(fstat(plugindir_fd, &st));

785

788

if(ret == -1){

808

811

809

812

/* Open plugin directory with close_on_exec flag */

810

813

{

811

int dir_fd = -1;

812

if(plugindir == NULL){

813

dir_fd = open(PDIR, O_RDONLY |

814

#ifdef O_CLOEXEC

815

O_CLOEXEC

816

#else /* not O_CLOEXEC */

817

0

818

#endif /* not O_CLOEXEC */

819

);

820

} else {

821

dir_fd = open(plugindir, O_RDONLY |

822

#ifdef O_CLOEXEC

823

O_CLOEXEC

824

#else /* not O_CLOEXEC */

825

0

826

#endif /* not O_CLOEXEC */

827

);

828

}

814

dir_fd = open(plugindir != NULL ? plugindir : PDIR, O_RDONLY |

815

#ifdef O_CLOEXEC

816

O_CLOEXEC

817

#else /* not O_CLOEXEC */

818

0

819

#endif /* not O_CLOEXEC */

820

);

829

821

if(dir_fd == -1){

830

822

error(0, errno, "Could not open plugin dir");

831

823

exitstatus = EX_UNAVAILABLE;

837

829

ret = set_cloexec_flag(dir_fd);

838

830

if(ret < 0){

839

831

error(0, errno, "set_cloexec_flag");

840

TEMP_FAILURE_RETRY(close(dir_fd));

841

832

exitstatus = EX_OSERR;

842

833

goto fallback;

843

834

}

844

835

#endif /* O_CLOEXEC */

845

846

dir = fdopendir(dir_fd);

847

if(dir == NULL){

848

error(0, errno, "Could not open plugin dir");

849

TEMP_FAILURE_RETRY(close(dir_fd));

850

exitstatus = EX_OSERR;

851

goto fallback;

836

}

837

838

int good_name(const struct dirent * const dirent){

839

const char * const patterns[] = { ".*", "#*#", "*~", "*.dpkg-new",

840

"*.dpkg-old", "*.dpkg-bak",

841

"*.dpkg-divert", NULL };

842

#ifdef __GNUC__

843

#pragma GCC diagnostic push

844

#pragma GCC diagnostic ignored "-Wcast-qual"

845

#endif

846

for(const char **pat = (const char **)patterns;

847

*pat != NULL; pat++){

848

#ifdef __GNUC__

849

#pragma GCC diagnostic pop

850

#endif

851

if(fnmatch(*pat, dirent->d_name, FNM_FILE_NAME | FNM_PERIOD)

852

!= FNM_NOMATCH){

853

if(debug){

854

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

855

" matching pattern %s\n", dirent->d_name, *pat);

856

}

857

return 0;

858

}

852

859

}

860

return 1;

861

}

862

863

#ifdef __GLIBC__

864

#if __GLIBC_PREREQ(2, 15)

865

int numplugins = scandirat(dir_fd, ".", &direntries, good_name,

866

alphasort);

867

#else /* not __GLIBC_PREREQ(2, 15) */

868

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

869

&direntries, good_name, alphasort);

870

#endif /* not __GLIBC_PREREQ(2, 15) */

871

#else /* not __GLIBC__ */

872

int numplugins = scandir(plugindir != NULL ? plugindir : PDIR,

873

&direntries, good_name, alphasort);

874

#endif /* not __GLIBC__ */

875

if(numplugins == -1){

876

error(0, errno, "Could not scan plugin dir");

877

direntries = NULL;

878

exitstatus = EX_OSERR;

879

goto fallback;

853

880

}

854

881

855

882

FD_ZERO(&rfds_all);

856

883

857

884

/* Read and execute any executable in the plugin directory*/

858

while(true){

859

do {

860

dirst = readdir(dir);

861

} while(dirst == NULL and errno == EINTR);

862

863

/* All directory entries have been processed */

864

if(dirst == NULL){

865

if(errno == EBADF){

866

error(0, errno, "readdir");

867

exitstatus = EX_IOERR;

868

goto fallback;

869

}

870

break;

871

}

872

873

d_name_len = strlen(dirst->d_name);

874

875

/* Ignore dotfiles, backup files and other junk */

876

{

877

bool bad_name = false;

878

879

const char * const bad_prefixes[] = { ".", "#", NULL };

880

881

const char * const bad_suffixes[] = { "~", "#", ".dpkg-new",

882

".dpkg-old",

883

".dpkg-bak",

884

".dpkg-divert", NULL };

885

#ifdef __GNUC__

886

#pragma GCC diagnostic push

887

#pragma GCC diagnostic ignored "-Wcast-qual"

888

#endif

889

for(const char **pre = (const char **)bad_prefixes;

890

*pre != NULL; pre++){

891

#ifdef __GNUC__

892

#pragma GCC diagnostic pop

893

#endif

894

size_t pre_len = strlen(*pre);

895

if((d_name_len >= pre_len)

896

and strncmp((dirst->d_name), *pre, pre_len) == 0){

897

if(debug){

898

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

899

" with bad prefix %s\n", dirst->d_name, *pre);

900

}

901

bad_name = true;

902

break;

903

}

904

}

905

if(bad_name){

906

continue;

907

}

908

#ifdef __GNUC__

909

#pragma GCC diagnostic push

910

#pragma GCC diagnostic ignored "-Wcast-qual"

911

#endif

912

for(const char **suf = (const char **)bad_suffixes;

913

*suf != NULL; suf++){

914

#ifdef __GNUC__

915

#pragma GCC diagnostic pop

916

#endif

917

size_t suf_len = strlen(*suf);

918

if((d_name_len >= suf_len)

919

and (strcmp((dirst->d_name) + d_name_len-suf_len, *suf)

920

== 0)){

921

if(debug){

922

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

923

" with bad suffix %s\n", dirst->d_name, *suf);

924

}

925

bad_name = true;

926

break;

927

}

928

}

929

930

if(bad_name){

931

continue;

932

}

933

}

934

935

char *filename;

936

if(plugindir == NULL){

937

ret = (int)TEMP_FAILURE_RETRY(asprintf(&filename, PDIR "/%s",

938

dirst->d_name));

939

} else {

940

ret = (int)TEMP_FAILURE_RETRY(asprintf(&filename, "%s/%s",

941

plugindir,

942

dirst->d_name));

943

}

944

if(ret < 0){

945

error(0, errno, "asprintf");

885

for(int i = 0; i < numplugins; i++){

886

887

int plugin_fd = openat(dir_fd, direntries[i]->d_name, O_RDONLY);

888

if(plugin_fd == -1){

889

error(0, errno, "Could not open plugin");

946

890

continue;

947

891

}

948

949

ret = (int)TEMP_FAILURE_RETRY(stat(filename, &st));

892

ret = (int)TEMP_FAILURE_RETRY(fstat(plugin_fd, &st));

950

893

if(ret == -1){

951

894

error(0, errno, "stat");

952

free(filename);

895

TEMP_FAILURE_RETRY(close(plugin_fd));

953

896

continue;

954

897

}

955

898

956

899

/* Ignore non-executable files */

957

900

if(not S_ISREG(st.st_mode)

958

or (TEMP_FAILURE_RETRY(access(filename, X_OK)) != 0)){

901

or (TEMP_FAILURE_RETRY(faccessat(dir_fd, direntries[i]->d_name,

902

X_OK, 0)) != 0)){

959

903

if(debug){

960

fprintf(stderr, "Ignoring plugin dir entry \"%s\""

961

" with bad type or mode\n", filename);

904

fprintf(stderr, "Ignoring plugin dir entry \"%s/%s\""

905

" with bad type or mode\n",

906

plugindir != NULL ? plugindir : PDIR,

907

direntries[i]->d_name);

962

908

}

963

free(filename);

909

TEMP_FAILURE_RETRY(close(plugin_fd));

964

910

continue;

965

911

}

966

912

967

plugin *p = getplugin(dirst->d_name);

913

plugin *p = getplugin(direntries[i]->d_name);

968

914

if(p == NULL){

969

915

error(0, errno, "getplugin");

970

free(filename);

916

TEMP_FAILURE_RETRY(close(plugin_fd));

971

917

continue;

972

918

}

973

919

if(p->disabled){

974

920

if(debug){

975

921

fprintf(stderr, "Ignoring disabled plugin \"%s\"\n",

976

dirst->d_name);

922

direntries[i]->d_name);

977

923

}

978

free(filename);

924

TEMP_FAILURE_RETRY(close(plugin_fd));

979

925

continue;

980

926

}

981

927

{

995

941

}

996

942

}

997

943

}

998

/* If this plugin has any environment variables, we will call

999

using execve and need to duplicate the environment from this

1000

process, too. */

944

/* If this plugin has any environment variables, we need to

945

duplicate the environment from this process, too. */

1001

946

if(p->environ[0] != NULL){

1002

947

for(char **e = environ; *e != NULL; e++){

1003

948

if(not add_environment(p, *e, false)){

1007

952

}

1008

953

1009

954

int pipefd[2];

955

#ifndef O_CLOEXEC

1010

956

ret = (int)TEMP_FAILURE_RETRY(pipe(pipefd));

957

#else /* O_CLOEXEC */

958

ret = (int)TEMP_FAILURE_RETRY(pipe2(pipefd, O_CLOEXEC));

959

#endif /* O_CLOEXEC */

1011

960

if(ret == -1){

1012

961

error(0, errno, "pipe");

1013

962

exitstatus = EX_OSERR;

1014

963

goto fallback;

1015

964

}

965

if(pipefd[0] >= FD_SETSIZE){

966

fprintf(stderr, "pipe()[0] (%d) >= FD_SETSIZE (%d)", pipefd[0],

967

FD_SETSIZE);

968

TEMP_FAILURE_RETRY(close(pipefd[0]));

969

TEMP_FAILURE_RETRY(close(pipefd[1]));

970

exitstatus = EX_OSERR;

971

goto fallback;

972

}

973

#ifndef O_CLOEXEC

1016

974

/* Ask OS to automatic close the pipe on exec */

1017

975

ret = set_cloexec_flag(pipefd[0]);

1018

976

if(ret < 0){

1019

977

error(0, errno, "set_cloexec_flag");

978

TEMP_FAILURE_RETRY(close(pipefd[0]));

979

TEMP_FAILURE_RETRY(close(pipefd[1]));

1020

980

exitstatus = EX_OSERR;

1021

981

goto fallback;

1022

982

}

1023

983

ret = set_cloexec_flag(pipefd[1]);

1024

984

if(ret < 0){

1025

985

error(0, errno, "set_cloexec_flag");

986

TEMP_FAILURE_RETRY(close(pipefd[0]));

987

TEMP_FAILURE_RETRY(close(pipefd[1]));

1026

988

exitstatus = EX_OSERR;

1027

989

goto fallback;

1028

990

}

991

#endif /* not O_CLOEXEC */

1029

992

/* Block SIGCHLD until process is safely in process list */

1030

993

ret = (int)TEMP_FAILURE_RETRY(sigprocmask(SIG_BLOCK,

1031

994

&sigchld_action.sa_mask,

1042

1005

} while(pid == -1 and errno == EINTR);

1043

1006

if(pid == -1){

1044

1007

error(0, errno, "fork");

1008

TEMP_FAILURE_RETRY(sigprocmask(SIG_UNBLOCK,

1009

&sigchld_action.sa_mask, NULL));

1010

TEMP_FAILURE_RETRY(close(pipefd[0]));

1011

TEMP_FAILURE_RETRY(close(pipefd[1]));

1045

1012

exitstatus = EX_OSERR;

1046

1013

goto fallback;

1047

1014

}

1064

1031

_exit(EX_OSERR);

1065

1032

}

1066

1033

1067

if(dirfd(dir) < 0){

1068

/* If dir has no file descriptor, we could not set FD_CLOEXEC

1069

above and must now close it manually here. */

1070

closedir(dir);

1071

}

1072

if(execve(filename, p->argv,

1034

if(fexecve(plugin_fd, p->argv,

1073

1035

(p->environ[0] != NULL) ? p->environ : environ) < 0){

1074

error(0, errno, "execve for %s", filename);

1036

error(0, errno, "fexecve for %s/%s",

1037

plugindir != NULL ? plugindir : PDIR,

1038

direntries[i]->d_name);

1075

1039

_exit(EX_OSERR);

1076

1040

}

1077

1041

/* no return */

1079

1043

/* Parent process */

1080

1044

TEMP_FAILURE_RETRY(close(pipefd[1])); /* Close unused write end of

1081

1045

pipe */

1082

free(filename);

1083

plugin *new_plugin = getplugin(dirst->d_name);

1046

TEMP_FAILURE_RETRY(close(plugin_fd));

1047

plugin *new_plugin = getplugin(direntries[i]->d_name);

1084

1048

if(new_plugin == NULL){

1085

1049

error(0, errno, "getplugin");

1086

1050

ret = (int)(TEMP_FAILURE_RETRY

1127

1091

}

1128

1092

}

1129

1093

1130

TEMP_FAILURE_RETRY(closedir(dir));

1131

dir = NULL;

1094

free(direntries);

1095

direntries = NULL;

1096

TEMP_FAILURE_RETRY(close(dir_fd));

1097

dir_fd = -1;

1132

1098

free_plugin(getplugin(NULL));

1133

1099

1134

1100

for(plugin *p = plugin_list; p != NULL; p = p->next){

1328

1294

free(custom_argv);

1329

1295

}

1330

1296

1331

if(dir != NULL){

1332

closedir(dir);

1297

free(direntries);

1298

1299

if(dir_fd != -1){

1300

TEMP_FAILURE_RETRY(close(dir_fd));

1333

1301

}

1334

1302

1335

1303

/* Kill the processes */