To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 734
- compare with another revision
- download diff
- download tarball
- view history from revision 734
- Committer: Teddy Hogeborn
- Date: 2014-10-05 19:39:25 UTC
- Revision ID: teddy@recompile.se-20141005193925-jjqx2n2dt3icy28u
* mandos.service ([Unit]/Documentation): New.
- files modified:
- DBUS-API
added
removed
plugins.d/mandos-client.c
234
234
.af = af };
235
235
if(new_server->ip == NULL){
236
236
perror_plus("strdup");
237
free(new_server);
237
238
return false;
238
239
}
239
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
240
241
if(ret == -1){
241
242
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
242
252
return false;
243
253
}
244
254
/* Special case of first server */
1066
1076
timed out */
1067
1077
1068
1078
if(quit_now){
1079
avahi_s_service_resolver_free(r);
1069
1080
return;
1070
1081
}
1071
1082
1458
1469
error_t ret_errno = 0;
1459
1470
if(seteuid(0) == -1){
1460
1471
ret_errno = errno;
1461
perror_plus("seteuid");
1462
1472
}
1463
1473
errno = old_errno;
1464
1474
return ret_errno;
1475
1485
}
1476
1486
if(setuid(0) == -1){
1477
1487
ret_errno = errno;
1478
perror_plus("seteuid");
1479
1488
}
1480
1489
errno = old_errno;
1481
1490
return ret_errno;
1488
1497
error_t ret_errno = 0;
1489
1498
if(seteuid(uid) == -1){
1490
1499
ret_errno = errno;
1491
perror_plus("seteuid");
1492
1500
}
1493
1501
errno = old_errno;
1494
1502
return ret_errno;
1501
1509
error_t ret_errno = 0;
1502
1510
if(setuid(uid) == -1){
1503
1511
ret_errno = errno;
1504
perror_plus("setuid");
1505
1512
}
1506
1513
errno = old_errno;
1507
1514
return ret_errno;
1508
1515
}
1509
1516
1510
#ifndef O_CLOEXEC
1511
/*
1512
* Based on the example in the GNU LibC manual chapter 13.13 "File
1513
* Descriptor Flags".
1514
| [[info:libc:Descriptor%20Flags][File Descriptor Flags]] |
1515
*/
1516
__attribute__((warn_unused_result))
1517
static int set_cloexec_flag(int fd){
1518
int ret = (int)TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD, 0));
1519
/* If reading the flags failed, return error indication now. */
1520
if(ret < 0){
1521
return ret;
1522
}
1523
/* Store modified flag word in the descriptor. */
1524
return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,
1525
ret | FD_CLOEXEC));
1526
}
1527
#endif /* not O_CLOEXEC */
1528
1529
1517
__attribute__((nonnull))
1530
1518
void run_network_hooks(const char *mode, const char *interface,
1531
1519
const float delay){
1532
struct dirent **direntries;
1520
struct dirent **direntries = NULL;
1533
1521
if(hookdir_fd == -1){
1534
hookdir_fd = open(hookdir, O_RDONLY |
1535
#ifdef O_CLOEXEC
1536
O_CLOEXEC
1537
#else /* not O_CLOEXEC */
1538
0
1539
#endif /* not O_CLOEXEC */
1540
);
1522
hookdir_fd = open(hookdir, O_RDONLY);
1541
1523
if(hookdir_fd == -1){
1542
1524
if(errno == ENOENT){
1543
1525
if(debug){
1549
1531
}
1550
1532
return;
1551
1533
}
1552
#ifndef O_CLOEXEC
1553
if(set_cloexec_flag(hookdir_fd) < 0){
1554
perror_plus("set_cloexec_flag");
1555
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1556
perror_plus("close");
1557
} else {
1558
hookdir_fd = -1;
1559
}
1560
return;
1561
}
1562
#endif /* not O_CLOEXEC */
1563
1534
}
1564
1535
#ifdef __GLIBC__
1565
1536
#if __GLIBC_PREREQ(2, 15)
1590
1561
if(hook_pid == 0){
1591
1562
/* Child */
1592
1563
/* Raise privileges */
1593
if(raise_privileges_permanently() != 0){
1564
errno = raise_privileges_permanently();
1565
if(errno != 0){
1594
1566
perror_plus("Failed to raise privileges");
1595
1567
_exit(EX_NOPERM);
1596
1568
}
1663
1635
_exit(EX_OSERR);
1664
1636
}
1665
1637
}
1666
if(fexecve(hookdir_fd, (char *const [])
1667
{ direntry->d_name, NULL }, environ) == -1){
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1639
if(hook_fd == -1){
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1642
}
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1646
}
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1648
environ) == -1){
1668
1649
perror_plus("fexecve");
1669
1650
_exit(EXIT_FAILURE);
1670
1651
}
1671
1652
} else {
1653
if(hook_pid == -1){
1654
perror_plus("fork");
1655
free(direntry);
1656
continue;
1657
}
1672
1658
int status;
1673
1659
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1674
1660
perror_plus("waitpid");
1661
free(direntry);
1675
1662
continue;
1676
1663
}
1677
1664
if(WIFEXITED(status)){
1679
1666
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1680
1667
" with status %d\n", direntry->d_name,
1681
1668
WEXITSTATUS(status));
1669
free(direntry);
1682
1670
continue;
1683
1671
}
1684
1672
} else if(WIFSIGNALED(status)){
1685
1673
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1686
1674
" signal %d\n", direntry->d_name,
1687
1675
WTERMSIG(status));
1676
free(direntry);
1688
1677
continue;
1689
1678
} else {
1690
1679
fprintf_plus(stderr, "Warning: network hook \"%s\""
1691
1680
" crashed\n", direntry->d_name);
1681
free(direntry);
1692
1682
continue;
1693
1683
}
1694
1684
}
1696
1686
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1697
1687
direntry->d_name);
1698
1688
}
1689
free(direntry);
1699
1690
}
1691
free(direntries);
1700
1692
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1701
1693
perror_plus("close");
1702
1694
} else {
1759
1751
/* Raise privileges */
1760
1752
ret_errno = raise_privileges();
1761
1753
if(ret_errno != 0){
1754
errno = ret_errno;
1762
1755
perror_plus("Failed to raise privileges");
1763
1756
}
1764
1757
1868
1861
/* Raise privileges */
1869
1862
ret_errno = raise_privileges();
1870
1863
if(ret_errno != 0){
1864
errno = ret_errno;
1871
1865
perror_plus("Failed to raise privileges");
1872
1866
}
1873
1867
2280
2274
2281
2275
/* If no interfaces were specified, make a list */
2282
2276
if(mc.interfaces == NULL){
2283
struct dirent **direntries;
2277
struct dirent **direntries = NULL;
2284
2278
/* Look for any good interfaces */
2285
2279
ret = scandir(sys_class_net, &direntries, good_interface,
2286
2280
alphasort);
2292
2286
if(ret_errno != 0){
2293
2287
errno = ret_errno;
2294
2288
perror_plus("argz_add");
2289
free(direntries[i]);
2295
2290
continue;
2296
2291
}
2297
2292
if(debug){
2298
2293
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2299
2294
direntries[i]->d_name);
2300
2295
}
2296
free(direntries[i]);
2301
2297
}
2302
2298
free(direntries);
2303
2299
} else {
2304
free(direntries);
2300
if(ret == 0){
2301
free(direntries);
2302
}
2305
2303
fprintf_plus(stderr, "Could not find a network interface\n");
2306
2304
exitcode = EXIT_FAILURE;
2307
2305
goto end;
2571
2569
mc.current_server->prev->next = NULL;
2572
2570
while(mc.current_server != NULL){
2573
2571
server *next = mc.current_server->next;
2572
#ifdef __GNUC__
2573
#pragma GCC diagnostic push
2574
#pragma GCC diagnostic ignored "-Wcast-qual"
2575
#endif
2576
free((char *)(mc.current_server->ip));
2577
#ifdef __GNUC__
2578
#pragma GCC diagnostic pop
2579
#endif
2574
2580
free(mc.current_server);
2575
2581
mc.current_server = next;
2576
2582
}
2580
2586
{
2581
2587
ret_errno = raise_privileges();
2582
2588
if(ret_errno != 0){
2589
errno = ret_errno;
2583
2590
perror_plus("Failed to raise privileges");
2584
2591
} else {
2585
2592
2608
2615
2609
2616
ret_errno = lower_privileges_permanently();
2610
2617
if(ret_errno != 0){
2618
errno = ret_errno;
2611
2619
perror_plus("Failed to lower privileges permanently");
2612
2620
}
2613
2621
}
2618
2626
/* Removes the GPGME temp directory and all files inside */
2619
2627
if(tempdir != NULL){
2620
2628
struct dirent **direntries = NULL;
2621
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY));
2629
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2630
O_NOFOLLOW));
2622
2631
if(tempdir_fd == -1){
2623
2632
perror_plus("open");
2624
2633
} else {
2625
int numentries = scandir(tempdir, &direntries, notdotentries,
2626
alphasort);
2627
if(numentries > 0){
2634
#ifdef __GLIBC__
2635
#if __GLIBC_PREREQ(2, 15)
2636
int numentries = scandirat(tempdir_fd, ".", &direntries,
2637
notdotentries, alphasort);
2638
#else /* not __GLIBC_PREREQ(2, 15) */
2639
int numentries = scandir(tempdir, &direntries, notdotentries,
2640
alphasort);
2641
#endif /* not __GLIBC_PREREQ(2, 15) */
2642
#else /* not __GLIBC__ */
2643
int numentries = scandir(tempdir, &direntries, notdotentries,
2644
alphasort);
2645
#endif /* not __GLIBC__ */
2646
if(numentries >= 0){
2628
2647
for(int i = 0; i < numentries; i++){
2629
2648
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2630
2649
if(ret == -1){
2632
2651
" \"%s\", 0): %s\n", tempdir,
2633
2652
direntries[i]->d_name, strerror(errno));
2634
2653
}
2654
free(direntries[i]);
2635
2655
}
2636
2656
2637
2657
/* need to clean even if 0 because man page doesn't specify */
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0