os.c revision 2c329da87c5c886e7f4468c69a9e6323121068cb
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson/*
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * Copyright (C) 1999-2002 Internet Software Consortium.
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews *
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * Permission to use, copy, modify, and distribute this software for any
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * purpose with or without fee is hereby granted, provided that the above
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * copyright notice and this permission notice appear in all copies.
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews *
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews * PERFORMANCE OF THIS SOFTWARE.
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews */
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User/* $Id: os.c,v 1.70 2004/09/29 06:45:37 marka Exp $ */
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#include <config.h>
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#include <stdarg.h>
eefe56c8b367d1e54361b0c55f9db9d9468a0d6aAndreas Gustafsson
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#include <sys/types.h> /* dev_t FreeBSD 2.1 */
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#include <sys/stat.h>
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#include <ctype.h>
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#include <errno.h>
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#include <fcntl.h>
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#include <grp.h> /* Required for initgroups() on IRIX. */
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#include <pwd.h>
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#include <stdio.h>
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#include <stdlib.h>
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews#include <signal.h>
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews#include <syslog.h>
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews#ifdef HAVE_TZSET
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews#include <time.h>
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews#endif
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews#include <unistd.h>
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews
683e751c957d8b209cc393ff603bea937f5565b0Mark Andrews#include <isc/buffer.h>
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#include <isc/file.h>
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#include <isc/print.h>
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews#include <isc/result.h>
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews#include <isc/strerror.h>
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#include <isc/string.h>
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews#include <named/main.h>
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews#include <named/os.h>
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrewsstatic char *pidfile = NULL;
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrewsstatic int devnullfd = -1;
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#ifndef ISC_FACILITY
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#define ISC_FACILITY LOG_DAEMON
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#endif
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews/*
a26e1cacef2047b1048febd5e8d756060b4bddb1Evan Hunt * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews */
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews#ifndef HAVE_LINUX_CAPABILITY_H
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews#undef HAVE_SYS_PRCTL_H
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#endif
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson/*
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * Linux defines:
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * (T) HAVE_LINUXTHREADS
a26e1cacef2047b1048febd5e8d756060b4bddb1Evan Hunt * (C) HAVE_LINUX_CAPABILITY_H
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * (P) HAVE_SYS_PRCTL_H
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * The possible cases are:
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * none: setuid() normally
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * T: no setuid()
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * C: setuid() normally, drop caps (keep CAP_SETUID)
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * T+C: no setuid(), drop caps (don't keep CAP_SETUID)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * T+C+P: setuid() early, drop caps (keep CAP_SETUID)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * C+P: setuid() normally, drop caps (keep CAP_SETUID)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * P: not possible
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * T+P: not possible
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews *
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * if (C)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * caps = BIND_SERVICE + CHROOT + SETGID
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * if ((T && C && P) || !T)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * caps += SETUID
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * endif
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * capset(caps)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * endif
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * if (T && C && P && -u)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * setuid()
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * else if (T && -u)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * fail
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * --> start threads
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * if (!T && -u)
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * setuid()
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * if (C && (P || !-u))
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * caps = BIND_SERVICE
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * capset(caps)
8f9755413f8814bbabbad40c850a81be52e05623Mark Andrews * endif
8f9755413f8814bbabbad40c850a81be52e05623Mark Andrews *
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * It will be nice when Linux threads work properly with setuid().
a60f32928e486c147fa66d74ba02eda74a5d1d42Mark Andrews */
8f9755413f8814bbabbad40c850a81be52e05623Mark Andrews
7964553eb43ab5146475841540c1c0d977e08b30Mark Andrews#ifdef HAVE_LINUXTHREADS
a26e1cacef2047b1048febd5e8d756060b4bddb1Evan Huntstatic pid_t mainpid = 0;
7964553eb43ab5146475841540c1c0d977e08b30Mark Andrews#endif
7964553eb43ab5146475841540c1c0d977e08b30Mark Andrews
7964553eb43ab5146475841540c1c0d977e08b30Mark Andrewsstatic struct passwd *runas_pw = NULL;
7964553eb43ab5146475841540c1c0d977e08b30Mark Andrewsstatic isc_boolean_t done_setuid = ISC_FALSE;
7964553eb43ab5146475841540c1c0d977e08b30Mark Andrewsstatic int dfd[2] = { -1, -1 };
7964553eb43ab5146475841540c1c0d977e08b30Mark Andrews
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#ifdef HAVE_LINUX_CAPABILITY_H
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson
b043b56271060295bd32f61e7b7221dd40fb60dcMark Andrewsstatic isc_boolean_t non_root = ISC_FALSE;
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafssonstatic isc_boolean_t non_root_caps = ISC_FALSE;
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson/*
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * We define _LINUX_FS_H to prevent it from being included. We don't need
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * anything from it, and the files it includes cause warnings with 2.2
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews * kernels, and compilation failures (due to conflicts between <linux/string.h>
a26e1cacef2047b1048febd5e8d756060b4bddb1Evan Hunt * and <string.h>) on 2.3 kernels.
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson */
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#define _LINUX_FS_H
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews#include <sys/syscall.h> /* Required for syscall(). */
a26e1cacef2047b1048febd5e8d756060b4bddb1Evan Hunt#include <linux/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews
bcf966e6146943ebcac1603a52468f5292612b18Evan Hunt#ifdef HAVE_SYS_PRCTL_H
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#include <sys/prctl.h> /* Required for prctl(). */
38bcbbf947f0611bcae2e127d004dab761770c64Mark Andrews
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson/*
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * If the value of PR_SET_KEEPCAPS is not in <sys/prctl.h>, define it
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * here. This allows setuid() to work on systems running a new enough
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * kernel but with /usr/include/linux pointing to "standard" kernel
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson * headers.
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson */
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#ifndef PR_SET_KEEPCAPS
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#define PR_SET_KEEPCAPS 8
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#endif
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson#endif /* HAVE_SYS_PRCTL_H */
c4213ed935163b25bde9273a7c1a79a6296a0662Andreas Gustafsson
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson#ifndef SYS_capset
6e8a02d5d3a845ca1768e92c88bdc0a4da47f95bAndreas Gustafsson#ifndef __NR_capset
6e8a02d5d3a845ca1768e92c88bdc0a4da47f95bAndreas Gustafsson#include <asm/unistd.h> /* Slackware 4.0 needs this. */
6e8a02d5d3a845ca1768e92c88bdc0a4da47f95bAndreas Gustafsson#endif
6e8a02d5d3a845ca1768e92c88bdc0a4da47f95bAndreas Gustafsson#define SYS_capset __NR_capset
6e8a02d5d3a845ca1768e92c88bdc0a4da47f95bAndreas Gustafsson#endif
6e8a02d5d3a845ca1768e92c88bdc0a4da47f95bAndreas Gustafsson
52f16aeb304bc13f6957e3ecf24c8c5b69991558Andreas Gustafssonstatic void
7d97663b2ca5b7b057276fc9d239025da80e4756Mark Andrewslinux_setcaps(unsigned int caps) {
7d97663b2ca5b7b057276fc9d239025da80e4756Mark Andrews struct __user_cap_header_struct caphead;
3aab1703a5594e64b75d629427f1f1dd717cf5abScott Mann struct __user_cap_data_struct cap;
534253444e569bf039fb6e5fc31a5e8c2e8305c0Mark Andrews char strbuf[ISC_STRERRORSIZE];
52f16aeb304bc13f6957e3ecf24c8c5b69991558Andreas Gustafsson
8a86c12ec245eb3838f48ffbc5a01fb9b7666a60Evan Hunt if ((getuid() != 0 && !non_root_caps) || non_root)
7c87a8bf7bc525f9b3ce80e7c12928a226e37d2bMark Andrews return;
05398561e0221fe1fef1457627a50c60bddbb022Mark Andrews
8a86c12ec245eb3838f48ffbc5a01fb9b7666a60Evan Hunt memset(&caphead, 0, sizeof(caphead));
a26e1cacef2047b1048febd5e8d756060b4bddb1Evan Hunt caphead.version = _LINUX_CAPABILITY_VERSION;
a26e1cacef2047b1048febd5e8d756060b4bddb1Evan Hunt caphead.pid = 0;
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson memset(&cap, 0, sizeof(cap));
bcf966e6146943ebcac1603a52468f5292612b18Evan Hunt cap.effective = caps;
bcf966e6146943ebcac1603a52468f5292612b18Evan Hunt cap.permitted = caps;
bcf966e6146943ebcac1603a52468f5292612b18Evan Hunt cap.inheritable = caps;
2e286ac71f3621c11a3409f35a859488026b5fb5Mark Andrews if (syscall(SYS_capset, &caphead, &cap) < 0) {
61d7ab455fe6c2c1be112e7f48a768b9db1f65bbMark Andrews isc__strerror(errno, strbuf, sizeof(strbuf));
61d7ab455fe6c2c1be112e7f48a768b9db1f65bbMark Andrews ns_main_earlyfatal("capset failed: %s:"
61d7ab455fe6c2c1be112e7f48a768b9db1f65bbMark Andrews " please ensure that the capset kernel"
61d7ab455fe6c2c1be112e7f48a768b9db1f65bbMark Andrews " module is loaded. see insmod(8)",
61d7ab455fe6c2c1be112e7f48a768b9db1f65bbMark Andrews strbuf);
61d7ab455fe6c2c1be112e7f48a768b9db1f65bbMark Andrews }
2e286ac71f3621c11a3409f35a859488026b5fb5Mark Andrews}
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrewsstatic void
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrewslinux_initialprivs(void) {
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews unsigned int caps;
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews /*
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews * We don't need most privileges, so we drop them right away.
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews * Later on linux_minprivs() will be called, which will drop our
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews * capabilities to the minimum needed to run the server.
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews */
c85ffa76df4b94e0c44b2924f7a7f2e875a1ea86Mark Andrews
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews caps = 0;
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews /*
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews * We need to be able to bind() to privileged ports, notably port 53!
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews */
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews caps |= (1 << CAP_NET_BIND_SERVICE);
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews /*
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews * We need chroot() initially too.
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews */
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews caps |= (1 << CAP_SYS_CHROOT);
3d2ce18535b3d2d828bd40aec7f4686519f305feMark Andrews
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews /*
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews * We can setuid() only if either the kernel supports keeping
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews * capabilities after setuid() (which we don't know until we've
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews * tried) or we're not using threads. If either of these is
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews * true, we want the setuid capability.
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews */
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews caps |= (1 << CAP_SETUID);
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews#endif
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews /*
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews * Since we call initgroups, we need this.
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews */
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews caps |= (1 << CAP_SETGID);
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews /*
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews * Without this, we run into problems reading a configuration file
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews * owned by a non-root user and non-world-readable on startup.
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews */
4347f7ac1286aaa114935823c3cd59151de0166bMark Andrews caps |= (1 << CAP_DAC_READ_SEARCH);
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson /*
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * XXX We might want to add CAP_SYS_RESOURCE, though it's not
1090574e9153ad41c403f812d9b6cef0334e828eMark Andrews * clear it would work right given the way linuxthreads work.
d49d75f5073294d798aa500728116309398bb535Andreas Gustafsson * XXXDCL But since we need to be able to set the maximum number
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
caps |= (1 << CAP_SYS_RESOURCE);
linux_setcaps(caps);
}
static void
linux_minprivs(void) {
unsigned int caps;
/*
* Drop all privileges except the ability to bind() to privileged
* ports.
*
* It's important that we drop CAP_SYS_CHROOT. If we didn't, it
* chroot() could be used to escape from the chrooted area.
*/
caps = 0;
caps |= (1 << CAP_NET_BIND_SERVICE);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
* clear it would work right given the way linuxthreads work.
* XXXDCL But since we need to be able to set the maximum number
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
caps |= (1 << CAP_SYS_RESOURCE);
linux_setcaps(caps);
}
#ifdef HAVE_SYS_PRCTL_H
static void
linux_keepcaps(void) {
char strbuf[ISC_STRERRORSIZE];
/*
* Ask the kernel to allow us to keep our capabilities after we
* setuid().
*/
if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
if (errno != EINVAL) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("prctl() failed: %s", strbuf);
}
} else {
non_root_caps = ISC_TRUE;
if (getuid() != 0)
non_root = ISC_TRUE;
}
}
#endif
#endif /* HAVE_LINUX_CAPABILITY_H */
static void
setup_syslog(const char *progname) {
int options;
options = LOG_PID;
#ifdef LOG_NDELAY
options |= LOG_NDELAY;
#endif
openlog(isc_file_basename(progname), options, ISC_FACILITY);
}
void
ns_os_init(const char *progname) {
setup_syslog(progname);
#ifdef HAVE_LINUX_CAPABILITY_H
linux_initialprivs();
#endif
#ifdef HAVE_LINUXTHREADS
mainpid = getpid();
#endif
#ifdef SIGXFSZ
signal(SIGXFSZ, SIG_IGN);
#endif
}
void
ns_os_daemonize(void) {
pid_t pid;
char strbuf[ISC_STRERRORSIZE];
if (pipe(dfd) == -1) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("pipe(): %s", strbuf);
}
pid = fork();
if (pid == -1) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("fork(): %s", strbuf);
}
if (pid != 0) {
int n;
/*
* Wait for the child to finish loading for the first time.
* This would be so much simpler if fork() worked once we
* were multi-threaded.
*/
(void)close(dfd[1]);
do {
char buf;
n = read(dfd[0], &buf, 1);
if (n == 1)
_exit(0);
} while (n == -1 && errno == EINTR);
_exit(1);
}
(void)close(dfd[0]);
/*
* We're the child.
*/
#ifdef HAVE_LINUXTHREADS
mainpid = getpid();
#endif
if (setsid() == -1) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("setsid(): %s", strbuf);
}
/*
* Try to set stdin, stdout, and stderr to /dev/null, but press
* on even if it fails.
*
* XXXMLG The close() calls here are unneeded on all but NetBSD, but
* are harmless to include everywhere. dup2() is supposed to close
* the FD if it is in use, but unproven-pthreads-0.16 is broken
* and will end up closing the wrong FD. This will be fixed eventually,
* and these calls will be removed.
*/
if (devnullfd != -1) {
if (devnullfd != STDIN_FILENO) {
(void)close(STDIN_FILENO);
(void)dup2(devnullfd, STDIN_FILENO);
}
if (devnullfd != STDOUT_FILENO) {
(void)close(STDOUT_FILENO);
(void)dup2(devnullfd, STDOUT_FILENO);
}
if (devnullfd != STDERR_FILENO) {
(void)close(STDERR_FILENO);
(void)dup2(devnullfd, STDERR_FILENO);
}
}
}
void
ns_os_started(void) {
char buf = 0;
/*
* Signal to the parent that we stated successfully.
*/
if (dfd[0] != -1 && dfd[1] != -1) {
write(dfd[1], &buf, 1);
close(dfd[1]);
dfd[0] = dfd[1] = -1;
}
}
void
ns_os_opendevnull(void) {
devnullfd = open("/dev/null", O_RDWR, 0);
}
void
ns_os_closedevnull(void) {
if (devnullfd != STDIN_FILENO &&
devnullfd != STDOUT_FILENO &&
devnullfd != STDERR_FILENO) {
close(devnullfd);
devnullfd = -1;
}
}
static isc_boolean_t
all_digits(const char *s) {
if (*s == '\0')
return (ISC_FALSE);
while (*s != '\0') {
if (!isdigit((*s)&0xff))
return (ISC_FALSE);
s++;
}
return (ISC_TRUE);
}
void
ns_os_chroot(const char *root) {
char strbuf[ISC_STRERRORSIZE];
if (root != NULL) {
if (chroot(root) < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("chroot(): %s", strbuf);
}
if (chdir("/") < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("chdir(/): %s", strbuf);
}
}
}
void
ns_os_inituserinfo(const char *username) {
char strbuf[ISC_STRERRORSIZE];
if (username == NULL)
return;
if (all_digits(username))
runas_pw = getpwuid((uid_t)atoi(username));
else
runas_pw = getpwnam(username);
endpwent();
if (runas_pw == NULL)
ns_main_earlyfatal("user '%s' unknown", username);
if (getuid() == 0) {
if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("initgroups(): %s", strbuf);
}
}
}
void
ns_os_changeuser(void) {
char strbuf[ISC_STRERRORSIZE];
if (runas_pw == NULL || done_setuid)
return;
done_setuid = ISC_TRUE;
#ifdef HAVE_LINUXTHREADS
#ifdef HAVE_LINUX_CAPABILITY_H
if (!non_root_caps)
#endif
ns_main_earlyfatal(
"-u not supported on Linux kernels older than "
"2.3.99-pre3 or 2.2.18 when using threads");
#endif
if (setgid(runas_pw->pw_gid) < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("setgid(): %s", strbuf);
}
if (setuid(runas_pw->pw_uid) < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
ns_main_earlyfatal("setuid(): %s", strbuf);
}
#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
void
ns_os_minprivs(void) {
#ifdef HAVE_SYS_PRCTL_H
linux_keepcaps();
#endif
#ifdef HAVE_LINUXTHREADS
ns_os_changeuser(); /* Call setuid() before threads are started */
#endif
#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
static int
safe_open(const char *filename, isc_boolean_t append) {
int fd;
struct stat sb;
if (stat(filename, &sb) == -1) {
if (errno != ENOENT)
return (-1);
} else if ((sb.st_mode & S_IFREG) == 0) {
errno = EOPNOTSUPP;
return (-1);
}
if (append)
fd = open(filename, O_WRONLY|O_CREAT|O_APPEND,
S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
else {
(void)unlink(filename);
fd = open(filename, O_WRONLY|O_CREAT|O_EXCL,
S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
}
return (fd);
}
static void
cleanup_pidfile(void) {
if (pidfile != NULL) {
(void)unlink(pidfile);
free(pidfile);
}
pidfile = NULL;
}
void
ns_os_writepidfile(const char *filename, isc_boolean_t first_time) {
int fd;
FILE *lockfile;
size_t len;
pid_t pid;
char strbuf[ISC_STRERRORSIZE];
void (*report)(const char *, ...);
/*
* The caller must ensure any required synchronization.
*/
report = first_time ? ns_main_earlyfatal : ns_main_earlywarning;
cleanup_pidfile();
if (filename == NULL)
return;
len = strlen(filename);
pidfile = malloc(len + 1);
if (pidfile == NULL) {
isc__strerror(errno, strbuf, sizeof(strbuf));
(*report)("couldn't malloc '%s': %s", filename, strbuf);
return;
}
/* This is safe. */
strcpy(pidfile, filename);
fd = safe_open(filename, ISC_FALSE);
if (fd < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
(*report)("couldn't open pid file '%s': %s", filename, strbuf);
free(pidfile);
pidfile = NULL;
return;
}
lockfile = fdopen(fd, "w");
if (lockfile == NULL) {
isc__strerror(errno, strbuf, sizeof(strbuf));
(*report)("could not fdopen() pid file '%s': %s",
filename, strbuf);
(void)close(fd);
cleanup_pidfile();
return;
}
#ifdef HAVE_LINUXTHREADS
pid = mainpid;
#else
pid = getpid();
#endif
if (fprintf(lockfile, "%ld\n", (long)pid) < 0) {
(*report)("fprintf() to pid file '%s' failed", filename);
(void)fclose(lockfile);
cleanup_pidfile();
return;
}
if (fflush(lockfile) == EOF) {
(*report)("fflush() to pid file '%s' failed", filename);
(void)fclose(lockfile);
cleanup_pidfile();
return;
}
(void)fclose(lockfile);
}
void
ns_os_shutdown(void) {
closelog();
cleanup_pidfile();
}
isc_result_t
ns_os_gethostname(char *buf, size_t len) {
int n;
n = gethostname(buf, len);
return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
}
static char *
next_token(char **stringp, const char *delim) {
char *res;
do {
res = strsep(stringp, delim);
if (res == NULL)
break;
} while (*res == '\0');
return (res);
}
void
ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
char *input, *ptr;
unsigned int n;
pid_t pid;
input = command;
/* Skip the command name. */
ptr = next_token(&input, " \t");
if (ptr == NULL)
return;
ptr = next_token(&input, " \t");
if (ptr == NULL)
return;
if (strcmp(ptr, "-p") != 0)
return;
#ifdef HAVE_LINUXTHREADS
pid = mainpid;
#else
pid = getpid();
#endif
n = snprintf((char *)isc_buffer_used(text),
isc_buffer_availablelength(text),
"pid: %ld", (long)pid);
/* Only send a message if it is complete. */
if (n < isc_buffer_availablelength(text))
isc_buffer_add(text, n);
}
void
ns_os_tzset(void) {
#ifdef HAVE_TZSET
tzset();
#endif
}