named/unix/os.c

	os.c revision 9935447b51456f598b45246d0114b8006049244d
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley/*
7d98a1783f222964bcde7d56dab77b822706204dBob Halley * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * Copyright (C) 1999-2002  Internet Software Consortium.
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * Permission to use, copy, modify, and/or distribute this software for any
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * purpose with or without fee is hereby granted, provided that the above
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * copyright notice and this permission notice appear in all copies.
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * PERFORMANCE OF THIS SOFTWARE.
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley */
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley
9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence/* $Id: os.c,v 1.90 2008/12/01 03:51:47 marka Exp $ */
9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley/*! \file */
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#include <config.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <stdarg.h>
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <sys/types.h>  /* dev_t FreeBSD 2.1 */
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley#include <sys/stat.h>
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#include <ctype.h>
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence#include <errno.h>
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence#include <fcntl.h>
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence#include <grp.h>        /* Required for initgroups() on IRIX. */
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence#include <pwd.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <stdio.h>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#include <stdlib.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <signal.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <syslog.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#ifdef HAVE_TZSET
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <time.h>
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#endif
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#include <unistd.h>
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#include <isc/buffer.h>
77771185071bf74d53378f1a3099a04d2af5153eBrian Wellington#include <isc/file.h>
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#include <isc/print.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <isc/resource.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#include <isc/result.h>
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#include <isc/strerror.h>
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley#include <isc/string.h>
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley#include <named/main.h>
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley#include <named/os.h>
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley#ifdef HAVE_LIBSCF
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley#include <named/ns_smf_globals.h>
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley#endif
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencestatic char *pidfile = NULL;
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrencestatic int devnullfd = -1;
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#ifndef ISC_FACILITY
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#define ISC_FACILITY LOG_DAEMON
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#endif
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley/*
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley */
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#ifndef HAVE_LINUX_CAPABILITY_H
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#undef HAVE_SYS_PRCTL_H
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#endif
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley/*
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * Linux defines:
77771185071bf74d53378f1a3099a04d2af5153eBrian Wellington *  (T) HAVE_LINUXTHREADS
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  (C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H)
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  (P) HAVE_SYS_PRCTL_H
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley * The possible cases are:
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  none:   setuid() normally
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  T:  no setuid()
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  C:  setuid() normally, drop caps (keep CAP_SETUID)
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  T+C:    no setuid(), drop caps (don't keep CAP_SETUID)
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  T+C+P:  setuid() early, drop caps (keep CAP_SETUID)
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  C+P:    setuid() normally, drop caps (keep CAP_SETUID)
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *  P:  not possible
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *  T+P:    not possible
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley *
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * if (C)
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *  caps = BIND_SERVICE + CHROOT + SETGID
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *  if ((T && C && P) || !T)
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *      caps += SETUID
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *  endif
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *  capset(caps)
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * endif
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * if (T && C && P && -u)
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley *  setuid()
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * else if (T && -u)
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *  fail
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * --> start threads
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * if (!T && -u)
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley *  setuid()
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * if (C && (P || !-u))
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley *  caps = BIND_SERVICE
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley *  capset(caps)
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * endif
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley *
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * It will be nice when Linux threads work properly with setuid().
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#ifdef HAVE_LINUXTHREADS
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halleystatic pid_t mainpid = 0;
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#endif
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halleystatic struct passwd *runas_pw = NULL;
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halleystatic isc_boolean_t done_setuid = ISC_FALSE;
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halleystatic int dfd[2] = { -1, -1 };
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#ifdef HAVE_LINUX_CAPABILITY_H
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halleystatic isc_boolean_t non_root = ISC_FALSE;
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halleystatic isc_boolean_t non_root_caps = ISC_FALSE;
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#ifdef HAVE_SYS_CAPABILITY_H
5e4b7294d88ab58371d8c98e05ea80086dcb67cdBob Halley#include <sys/capability.h>
5e4b7294d88ab58371d8c98e05ea80086dcb67cdBob Halley#else
5e4b7294d88ab58371d8c98e05ea80086dcb67cdBob Halley/*%
5e4b7294d88ab58371d8c98e05ea80086dcb67cdBob Halley * We define _LINUX_FS_H to prevent it from being included.  We don't need
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * anything from it, and the files it includes cause warnings with 2.2
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * kernels, and compilation failures (due to conflicts between <linux/string.h>
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * and <string.h>) on 2.3 kernels.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#define _LINUX_FS_H
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#include <linux/capability.h>
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#include <syscall.h>
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#ifndef SYS_capset
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#ifndef __NR_capset
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#include <asm/unistd.h> /* Slackware 4.0 needs this. */
5e4b7294d88ab58371d8c98e05ea80086dcb67cdBob Halley#endif /* __NR_capset */
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#define SYS_capset __NR_capset
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#endif /* SYS_capset */
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#endif /* HAVE_SYS_CAPABILITY_H */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#ifdef HAVE_SYS_PRCTL_H
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#include <sys/prctl.h>      /* Required for prctl(). */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley/*
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * If the value of PR_SET_KEEPCAPS is not in <sys/prctl.h>, define it
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * here.  This allows setuid() to work on systems running a new enough
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley * kernel but with /usr/include/linux pointing to "standard" kernel
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley * headers.
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley */
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#ifndef PR_SET_KEEPCAPS
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#define PR_SET_KEEPCAPS 8
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#endif
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#endif /* HAVE_SYS_PRCTL_H */
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#ifdef HAVE_LIBCAP
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#define SETCAPS_FUNC "cap_set_proc "
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#else
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halleytypedef unsigned int cap_t;
77771185071bf74d53378f1a3099a04d2af5153eBrian Wellington#define SETCAPS_FUNC "syscall(capset) "
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#endif /* HAVE_LIBCAP */
77771185071bf74d53378f1a3099a04d2af5153eBrian Wellington
77771185071bf74d53378f1a3099a04d2af5153eBrian Wellingtonstatic void
77771185071bf74d53378f1a3099a04d2af5153eBrian Wellingtonlinux_setcaps(cap_t caps) {
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley#ifndef HAVE_LIBCAP
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    struct __user_cap_header_struct caphead;
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    struct __user_cap_data_struct cap;
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#endif
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    char strbuf[ISC_STRERRORSIZE];
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    if ((getuid() != 0 && !non_root_caps) || non_root)
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley        return;
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley#ifndef HAVE_LIBCAP
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    memset(&caphead, 0, sizeof(caphead));
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    caphead.version = _LINUX_CAPABILITY_VERSION;
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    caphead.pid = 0;
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    memset(&cap, 0, sizeof(cap));
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    cap.effective = caps;
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    cap.permitted = caps;
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    cap.inheritable = 0;
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley#endif
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#ifdef HAVE_LIBCAP
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    if (cap_set_proc(caps) < 0) {
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#else
1fc4929aa610263a2362afed516d7dc8e689397dBob Halley    if (syscall(SYS_capset, &caphead, &cap) < 0) {
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley#endif
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley        isc__strerror(errno, strbuf, sizeof(strbuf));
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley        ns_main_earlyfatal(SETCAPS_FUNC "failed: %s:"
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley                   " please ensure that the capset kernel"
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley                   " module is loaded.  see insmod(8)",
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley                   strbuf);
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley    }
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley}
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley#ifdef HAVE_LIBCAP
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley#define SET_CAP(flag) \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley    do { \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        capval = (flag); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        cap_flag_value_t curval; \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        err = cap_get_flag(curcaps, capval, CAP_PERMITTED, &curval); \
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley        if (err != -1 && curval) { \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley            err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
ed0b018ee06295f5fa8c45412486d40f219f2fefMichael Graff            if (err == -1) { \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley                isc__strerror(errno, strbuf, sizeof(strbuf)); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley                ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley            } \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley            \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley            err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley            if (err == -1) { \
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley                isc__strerror(errno, strbuf, sizeof(strbuf)); \
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley                ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley            } \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        } \
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    } while (0)
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley#define INIT_CAP \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley    do { \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        caps = cap_init(); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        if (caps == NULL) { \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley            isc__strerror(errno, strbuf, sizeof(strbuf)); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley            ns_main_earlyfatal("cap_init failed: %s", strbuf); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        } \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        curcaps = cap_get_proc(); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        if (curcaps == NULL) { \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley            isc__strerror(errno, strbuf, sizeof(strbuf)); \
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley            ns_main_earlyfatal("cap_get_proc failed: %s", strbuf); \
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley        } \
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    } while (0)
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#define FREE_CAP \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley    { \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        cap_free(caps); \
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley        cap_free(curcaps); \
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    } while (0)
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#else
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#define SET_CAP(flag) do { caps |= (1 << (flag)); } while (0)
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#define INIT_CAP do { caps = 0; } while (0)
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#endif /* HAVE_LIBCAP */
e63f7c6f556aef66ff81fb128605f9eadf1ddcd9Mark Andrews
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halleystatic void
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halleylinux_initialprivs(void) {
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    cap_t caps;
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#ifdef HAVE_LIBCAP
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    cap_t curcaps;
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    cap_value_t capval;
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    char strbuf[ISC_STRERRORSIZE];
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    int err;
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#endif
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    /*%
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * We don't need most privileges, so we drop them right away.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * Later on linux_minprivs() will be called, which will drop our
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * capabilities to the minimum needed to run the server.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    INIT_CAP;
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    /*
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * We need to be able to bind() to privileged ports, notably port 53!
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    SET_CAP(CAP_NET_BIND_SERVICE);
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    /*
e5afb85e525b2d2ed248dca0a954a124a704b206Andreas Gustafsson     * We need chroot() initially too.
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     */
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    SET_CAP(CAP_SYS_CHROOT);
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
e5afb85e525b2d2ed248dca0a954a124a704b206Andreas Gustafsson#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    /*
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * We can setuid() only if either the kernel supports keeping
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * capabilities after setuid() (which we don't know until we've
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * tried) or we're not using threads.  If either of these is
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * true, we want the setuid capability.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    SET_CAP(CAP_SETUID);
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley#endif
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    /*
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     * Since we call initgroups, we need this.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley     */
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    SET_CAP(CAP_SETGID);
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley    /*
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * Without this, we run into problems reading a configuration file
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     * owned by a non-root user and non-world-readable on startup.
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     */
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    SET_CAP(CAP_DAC_READ_SEARCH);
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    /*
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     *      clear it would work right given the way linuxthreads work.
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     * XXXDCL But since we need to be able to set the maximum number
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     * of files, the stack size, data size, and core dump size to
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     * support named.conf options, this is now being added to test.
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley     */
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    SET_CAP(CAP_SYS_RESOURCE);
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley    linux_setcaps(caps);
134ba0e08a0ae9a564a8d8628fc633377d3fc239Bob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#ifdef HAVE_LIBCAP
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    FREE_CAP;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#endif
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley}
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halleystatic void
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halleylinux_minprivs(void) {
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    cap_t caps;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#ifdef HAVE_LIBCAP
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    cap_t curcaps;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    cap_value_t capval;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    char strbuf[ISC_STRERRORSIZE];
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    int err;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#endif
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    INIT_CAP;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    /*%
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * Drop all privileges except the ability to bind() to privileged
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * ports.
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     *
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * It's important that we drop CAP_SYS_CHROOT.  If we didn't, it
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * chroot() could be used to escape from the chrooted area.
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     */
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    SET_CAP(CAP_NET_BIND_SERVICE);
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    /*
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     *      clear it would work right given the way linuxthreads work.
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * XXXDCL But since we need to be able to set the maximum number
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * of files, the stack size, data size, and core dump size to
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * support named.conf options, this is now being added to test.
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     */
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    SET_CAP(CAP_SYS_RESOURCE);
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    linux_setcaps(caps);
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#ifdef HAVE_LIBCAP
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    FREE_CAP;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#endif
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley}
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#ifdef HAVE_SYS_PRCTL_H
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halleystatic void
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halleylinux_keepcaps(void) {
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    char strbuf[ISC_STRERRORSIZE];
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    /*%
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * Ask the kernel to allow us to keep our capabilities after we
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     * setuid().
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley     */
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley        if (errno != EINVAL) {
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley            isc__strerror(errno, strbuf, sizeof(strbuf));
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley            ns_main_earlyfatal("prctl() failed: %s", strbuf);
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley        }
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    } else {
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley        non_root_caps = ISC_TRUE;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley        if (getuid() != 0)
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley            non_root = ISC_TRUE;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    }
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley}
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#endif
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley#endif  /* HAVE_LINUX_CAPABILITY_H */
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halleystatic void
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halleysetup_syslog(const char *progname) {
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley    int options;
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley
    options = LOG_PID;
#ifdef LOG_NDELAY
    options |= LOG_NDELAY;
#endif
    openlog(isc_file_basename(progname), options, ISC_FACILITY);
}

void
ns_os_init(const char *progname) {
    setup_syslog(progname);
#ifdef HAVE_LINUX_CAPABILITY_H
    linux_initialprivs();
#endif
#ifdef HAVE_LINUXTHREADS
    mainpid = getpid();
#endif
#ifdef SIGXFSZ
    signal(SIGXFSZ, SIG_IGN);
#endif
}

void
ns_os_daemonize(void) {
    pid_t pid;
    char strbuf[ISC_STRERRORSIZE];

    if (pipe(dfd) == -1) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        ns_main_earlyfatal("pipe(): %s", strbuf);
    }

    pid = fork();
    if (pid == -1) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        ns_main_earlyfatal("fork(): %s", strbuf);
    }
    if (pid != 0) {
        int n;
        /*
         * Wait for the child to finish loading for the first time.
         * This would be so much simpler if fork() worked once we
         * were multi-threaded.
         */
        (void)close(dfd[1]);
        do {
            char buf;
            n = read(dfd[0], &buf, 1);
            if (n == 1)
                _exit(0);
        } while (n == -1 && errno == EINTR);
        _exit(1);
    }
    (void)close(dfd[0]);

    /*
     * We're the child.
     */

#ifdef HAVE_LINUXTHREADS
    mainpid = getpid();
#endif

    if (setsid() == -1) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        ns_main_earlyfatal("setsid(): %s", strbuf);
    }

    /*
     * Try to set stdin, stdout, and stderr to /dev/null, but press
     * on even if it fails.
     *
     * XXXMLG The close() calls here are unneeded on all but NetBSD, but
     * are harmless to include everywhere.  dup2() is supposed to close
     * the FD if it is in use, but unproven-pthreads-0.16 is broken
     * and will end up closing the wrong FD.  This will be fixed eventually,
     * and these calls will be removed.
     */
    if (devnullfd != -1) {
        if (devnullfd != STDIN_FILENO) {
            (void)close(STDIN_FILENO);
            (void)dup2(devnullfd, STDIN_FILENO);
        }
        if (devnullfd != STDOUT_FILENO) {
            (void)close(STDOUT_FILENO);
            (void)dup2(devnullfd, STDOUT_FILENO);
        }
        if (devnullfd != STDERR_FILENO) {
            (void)close(STDERR_FILENO);
            (void)dup2(devnullfd, STDERR_FILENO);
        }
    }
}

void
ns_os_started(void) {
    char buf = 0;

    /*
     * Signal to the parent that we stated successfully.
     */
    if (dfd[0] != -1 && dfd[1] != -1) {
        write(dfd[1], &buf, 1);
        close(dfd[1]);
        dfd[0] = dfd[1] = -1;
    }
}

void
ns_os_opendevnull(void) {
    devnullfd = open("/dev/null", O_RDWR, 0);
}

void
ns_os_closedevnull(void) {
    if (devnullfd != STDIN_FILENO &&
        devnullfd != STDOUT_FILENO &&
        devnullfd != STDERR_FILENO) {
        close(devnullfd);
        devnullfd = -1;
    }
}

static isc_boolean_t
all_digits(const char *s) {
    if (*s == '\0')
        return (ISC_FALSE);
    while (*s != '\0') {
        if (!isdigit((*s)&0xff))
            return (ISC_FALSE);
        s++;
    }
    return (ISC_TRUE);
}

void
ns_os_chroot(const char *root) {
    char strbuf[ISC_STRERRORSIZE];
#ifdef HAVE_LIBSCF
    ns_smf_chroot = 0;
#endif
    if (root != NULL) {
#ifdef HAVE_CHROOT
        if (chroot(root) < 0) {
            isc__strerror(errno, strbuf, sizeof(strbuf));
            ns_main_earlyfatal("chroot(): %s", strbuf);
        }
#else
        ns_main_earlyfatal("chroot(): disabled");
#endif
        if (chdir("/") < 0) {
            isc__strerror(errno, strbuf, sizeof(strbuf));
            ns_main_earlyfatal("chdir(/): %s", strbuf);
        }
#ifdef HAVE_LIBSCF
        /* Set ns_smf_chroot flag on successful chroot. */
        ns_smf_chroot = 1;
#endif
    }
}

void
ns_os_inituserinfo(const char *username) {
    char strbuf[ISC_STRERRORSIZE];
    if (username == NULL)
        return;

    if (all_digits(username))
        runas_pw = getpwuid((uid_t)atoi(username));
    else
        runas_pw = getpwnam(username);
    endpwent();

    if (runas_pw == NULL)
        ns_main_earlyfatal("user '%s' unknown", username);

    if (getuid() == 0) {
        if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0) {
            isc__strerror(errno, strbuf, sizeof(strbuf));
            ns_main_earlyfatal("initgroups(): %s", strbuf);
        }
    }

}

void
ns_os_changeuser(void) {
    char strbuf[ISC_STRERRORSIZE];
    if (runas_pw == NULL || done_setuid)
        return;

    done_setuid = ISC_TRUE;

#ifdef HAVE_LINUXTHREADS
#ifdef HAVE_LINUX_CAPABILITY_H
    if (!non_root_caps)
        ns_main_earlyfatal("-u with Linux threads not supported: "
                   "requires kernel support for "
                   "prctl(PR_SET_KEEPCAPS)");
#else
    ns_main_earlyfatal("-u with Linux threads not supported: "
               "no capabilities support or capabilities "
               "disabled at build time");
#endif
#endif

    if (setgid(runas_pw->pw_gid) < 0) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        ns_main_earlyfatal("setgid(): %s", strbuf);
    }

    if (setuid(runas_pw->pw_uid) < 0) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        ns_main_earlyfatal("setuid(): %s", strbuf);
    }

#if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
    /*
     * Restore the ability of named to drop core after the setuid()
     * call has disabled it.
     */
    if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        ns_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
                     strbuf);
    }
#endif
#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
    linux_minprivs();
#endif
}

void
ns_os_adjustnofile() {
#ifdef HAVE_LINUXTHREADS
    isc_result_t result;
    isc_resourcevalue_t newvalue;

    /*
     * Linux: max number of open files specified by one thread doesn't seem
     * to apply to other threads on Linux.
     */
    newvalue = ISC_RESOURCE_UNLIMITED;

    result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
    if (result != ISC_R_SUCCESS)
        ns_main_earlywarning("couldn't adjust limit on open files");
#endif
}

void
ns_os_minprivs(void) {
#ifdef HAVE_SYS_PRCTL_H
    linux_keepcaps();
#endif

#ifdef HAVE_LINUXTHREADS
    ns_os_changeuser(); /* Call setuid() before threads are started */
#endif

#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
    linux_minprivs();
#endif
}

static int
safe_open(const char *filename, isc_boolean_t append) {
    int fd;
    struct stat sb;

    if (stat(filename, &sb) == -1) {
        if (errno != ENOENT)
            return (-1);
    } else if ((sb.st_mode & S_IFREG) == 0) {
        errno = EOPNOTSUPP;
        return (-1);
    }

    if (append)
        fd = open(filename, O_WRONLY|O_CREAT|O_APPEND,
              S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
    else {
        (void)unlink(filename);
        fd = open(filename, O_WRONLY|O_CREAT|O_EXCL,
              S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
    }
    return (fd);
}

static void
cleanup_pidfile(void) {
    if (pidfile != NULL) {
        (void)unlink(pidfile);
        free(pidfile);
    }
    pidfile = NULL;
}

void
ns_os_writepidfile(const char *filename, isc_boolean_t first_time) {
    int fd;
    FILE *lockfile;
    size_t len;
    pid_t pid;
    char strbuf[ISC_STRERRORSIZE];
    void (*report)(const char *, ...);
    unsigned int mode;
    char *slash;
    int n;

    /*
     * The caller must ensure any required synchronization.
     */

    report = first_time ? ns_main_earlyfatal : ns_main_earlywarning;

    cleanup_pidfile();

    if (filename == NULL)
        return;

    len = strlen(filename);
    pidfile = malloc(len + 1);
    if (pidfile == NULL) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        (*report)("couldn't malloc '%s': %s", filename, strbuf);
        return;
    }
    /* This is safe. */
    strcpy(pidfile, filename);

    /*
     * Make the containing directory if it doesn't exist.
     */
    slash = strrchr(pidfile, '/');
    if (slash != NULL && slash != pidfile) {
        *slash = '\0';
        mode = S_IRUSR | S_IWUSR | S_IXUSR; /* u=rwx */
        mode |= S_IRGRP | S_IXGRP;      /* g=rx */
        mode |= S_IROTH | S_IXOTH;      /* o=rx */
        n = mkdir(pidfile, mode);
        if (n == -1 && errno != EEXIST) {
            isc__strerror(errno, strbuf, sizeof(strbuf));
            (*report)("couldn't mkdir %s': %s", filename,
                  strbuf);
            free(pidfile);
            pidfile = NULL;
            return;
        }
        *slash = '/';
    }

    fd = safe_open(filename, ISC_FALSE);
    if (fd < 0) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        (*report)("couldn't open pid file '%s': %s", filename, strbuf);
        free(pidfile);
        pidfile = NULL;
        return;
    }
    lockfile = fdopen(fd, "w");
    if (lockfile == NULL) {
        isc__strerror(errno, strbuf, sizeof(strbuf));
        (*report)("could not fdopen() pid file '%s': %s",
              filename, strbuf);
        (void)close(fd);
        cleanup_pidfile();
        return;
    }
#ifdef HAVE_LINUXTHREADS
    pid = mainpid;
#else
    pid = getpid();
#endif
    if (fprintf(lockfile, "%ld\n", (long)pid) < 0) {
        (*report)("fprintf() to pid file '%s' failed", filename);
        (void)fclose(lockfile);
        cleanup_pidfile();
        return;
    }
    if (fflush(lockfile) == EOF) {
        (*report)("fflush() to pid file '%s' failed", filename);
        (void)fclose(lockfile);
        cleanup_pidfile();
        return;
    }
    (void)fclose(lockfile);
}

void
ns_os_shutdown(void) {
    closelog();
    cleanup_pidfile();
}

isc_result_t
ns_os_gethostname(char *buf, size_t len) {
    int n;

    n = gethostname(buf, len);
    return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
}

static char *
next_token(char **stringp, const char *delim) {
    char *res;

    do {
        res = strsep(stringp, delim);
        if (res == NULL)
            break;
    } while (*res == '\0');
    return (res);
}

void
ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
    char *input, *ptr;
    unsigned int n;
    pid_t pid;

    input = command;

    /* Skip the command name. */
    ptr = next_token(&input, " \t");
    if (ptr == NULL)
        return;

    ptr = next_token(&input, " \t");
    if (ptr == NULL)
        return;

    if (strcmp(ptr, "-p") != 0)
        return;

#ifdef HAVE_LINUXTHREADS
    pid = mainpid;
#else
    pid = getpid();
#endif

    n = snprintf((char *)isc_buffer_used(text),
             isc_buffer_availablelength(text),
             "pid: %ld", (long)pid);
    /* Only send a message if it is complete. */
    if (n < isc_buffer_availablelength(text))
        isc_buffer_add(text, n);
}

void
ns_os_tzset(void) {
#ifdef HAVE_TZSET
    tzset();
#endif
}