named/unix/os.c

	os.c revision d1e4b08844175357a925ddd6dcfa750cccd2b116
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews/*
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont * Copyright (C) 1999, 2000  Internet Software Consortium.
adabefa84c3dcf048566cc23fd457c577f208eeaTinderbox User *
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont * Permission to use, copy, modify, and distribute this software for any
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User * purpose with or without fee is hereby granted, provided that the above
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User * copyright notice and this permission notice appear in all copies.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User *
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User/* $Id: os.c,v 1.31 2000/08/10 18:56:58 bwelling Exp $ */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <config.h>
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <sys/stat.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <ctype.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <errno.h>
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#include <fcntl.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <grp.h>        /* Required for initgroups() on IRIX. */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <pwd.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <stdio.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <stdlib.h>
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#include <syslog.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <unistd.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <isc/string.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <named/main.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <named/os.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic char *pidfile = NULL;
adabefa84c3dcf048566cc23fd457c577f208eeaTinderbox User#ifdef HAVE_LINUXTHREADS
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic pid_t mainpid = 0;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic isc_boolean_t non_root_caps = ISC_FALSE;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic isc_boolean_t non_root = ISC_FALSE;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic struct passwd *runas_pw = NULL;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic isc_boolean_t done_setuid = ISC_FALSE;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUX_CAPABILITY_H
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User/*
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User * We define _LINUX_FS_H to prevent it from being included.  We don't need
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User * anything from it, and the files it includes cause warnings with 2.2
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User * kernels, and compilation failures (due to conflicts between <linux/string.h>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User * and <string.h>) on 2.3 kernels.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#define _LINUX_FS_H
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <sys/syscall.h>    /* Required for syscall(). */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#include <linux/capability.h>   /* Required for _LINUX_CAPABILITY_VERSION. */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUX_PRCTL_H
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#include <sys/prctl.h>      /* Required for prctl(). */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User/*
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User * If the value of PR_SET_KEEPCAPS is not in <linux/prctl.h>, define it
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User * here.  This allows setuid() to work on systems running a new enough
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User * kernel but with /usr/include/linux pointing to "standard" kernel
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User * headers.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User */
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User#ifndef PR_SET_KEEPCAPS
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User#define PR_SET_KEEPCAPS 8
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User#endif
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#endif /* HAVE_LINUX_PRCTL_H */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifndef SYS_capset
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User#define SYS_capset __NR_capset
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User#endif
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User
de283bda6a902c2102a795192eeab3a769001c7dTinderbox Userstatic void
de283bda6a902c2102a795192eeab3a769001c7dTinderbox Userlinux_setcaps(unsigned int caps) {
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User    struct __user_cap_header_struct caphead;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    struct __user_cap_data_struct cap;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    if ((getuid() != 0 && !non_root_caps) || non_root)
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User        return;
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User    memset(&caphead, 0, sizeof caphead);
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User    caphead.version = _LINUX_CAPABILITY_VERSION;
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User    caphead.pid = 0;
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User    memset(&cap, 0, sizeof cap);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    cap.effective = caps;
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User    cap.permitted = caps;
de283bda6a902c2102a795192eeab3a769001c7dTinderbox User    cap.inheritable = caps;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (syscall(SYS_capset, &caphead, &cap) < 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        ns_main_earlyfatal("capset failed: %s", strerror(errno));
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontstatic void
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontlinux_initialprivs(void) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    unsigned int caps;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    /*
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * We don't need most privileges, so we drop them right away.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * Later on linux_minprivs() will be called, which will drop our
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * capabilities to the minimum needed to run the server.
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    caps = 0;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    /*
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * We need to be able to bind() to privileged ports, notably port 53!
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    caps |= (1 << CAP_NET_BIND_SERVICE);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User    /*
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * We need chroot() initially too.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    caps |= (1 << CAP_SYS_CHROOT);
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#ifdef HAVE_LINUX_PRCTL_H
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    /*
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * If the kernel supports keeping capabilities after setuid(), we
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * also want the setuid capability.  We don't know until we've tried.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User     */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    caps |= (1 << CAP_SETUID);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User    /*
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * Since we call initgroups, we need this.
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    caps |= (1 << CAP_SETGID);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User    /*
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     *      clear it would work right given the way linuxthreads work.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    linux_setcaps(caps);
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User}
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic void
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userlinux_minprivs(void) {
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User    unsigned int caps;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    /*
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * Drop all privileges except the ability to bind() to privileged
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * ports.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User     *
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * It's important that we drop CAP_SYS_CHROOT.  If we didn't, it
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * chroot() could be used to escape from the chrooted area.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    caps = 0;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    caps |= (1 << CAP_NET_BIND_SERVICE);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    linux_setcaps(caps);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUX_PRCTL_H
adabefa84c3dcf048566cc23fd457c577f208eeaTinderbox Userstatic void
adabefa84c3dcf048566cc23fd457c577f208eeaTinderbox Userlinux_keepcaps(void) {
adabefa84c3dcf048566cc23fd457c577f208eeaTinderbox User    /*
adabefa84c3dcf048566cc23fd457c577f208eeaTinderbox User     * Ask the kernel to allow us to keep our capabilities after we
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * setuid().
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User        if (errno != EINVAL)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont            ns_main_earlyfatal("prctl() failed: %s",
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont                       strerror(errno));
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    } else {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        non_root_caps = ISC_TRUE;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        if (getuid() != 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User            non_root = ISC_TRUE;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    }
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User#endif
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif  /* HAVE_LINUX_CAPABILITY_H */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontstatic void
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Usersetup_syslog(const char *progname) {
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    int options;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    options = LOG_PID;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef LOG_NDELAY
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    options |= LOG_NDELAY;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    openlog(progname, options, LOG_DAEMON);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User}
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontvoid
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontns_os_init(const char *progname) {
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    setup_syslog(progname);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUX_CAPABILITY_H
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    linux_initialprivs();
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUXTHREADS
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    mainpid = getpid();
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User}
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontvoid
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userns_os_daemonize(void) {
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    pid_t pid;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    int fd;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    pid = fork();
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    if (pid == -1)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        ns_main_earlyfatal("fork(): %s", strerror(errno));
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (pid != 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        _exit(0);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    /*
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * We're the child.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#ifdef HAVE_LINUXTHREADS
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    mainpid = getpid();
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        if (setsid() == -1)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        ns_main_earlyfatal("setsid(): %s", strerror(errno));
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
ea640e04eae220b5e569f188563eb1f204c7c77eTinderbox User    /*
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * Try to set stdin, stdout, and stderr to /dev/null, but press
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * on even if it fails.
ea640e04eae220b5e569f188563eb1f204c7c77eTinderbox User     *
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * XXXMLG The close() calls here are unneeded on all but NetBSD, but
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * are harmless to include everywhere.  dup2() is supposed to close
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * the FD if it is in use, but unproven-pthreads-0.16 is broken
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * and will end up closing the wrong FD.  This will be fixed eventually,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     * and these calls will be removed.
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    fd = open("/dev/null", O_RDWR, 0);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (fd != -1) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        close(STDIN_FILENO);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        (void)dup2(fd, STDIN_FILENO);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        close(STDOUT_FILENO);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        (void)dup2(fd, STDOUT_FILENO);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        close(STDERR_FILENO);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        (void)dup2(fd, STDERR_FILENO);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        if (fd != STDIN_FILENO &&
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont            fd != STDOUT_FILENO &&
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User            fd != STDERR_FILENO)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User            (void)close(fd);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    }
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userstatic isc_boolean_t
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userall_digits(const char *s) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (*s == '\0')
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        return (ISC_FALSE);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    while (*s != '\0') {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        if (!isdigit((*s)&0xff))
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont            return (ISC_FALSE);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        s++;
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User    }
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    return (ISC_TRUE);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User}
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontvoid
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userns_os_chroot(const char *root) {
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    if (root != NULL) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        if (chroot(root) < 0)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont            ns_main_earlyfatal("chroot(): %s", strerror(errno));
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        if (chdir("/") < 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User            ns_main_earlyfatal("chdir(/): %s", strerror(errno));
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    }
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Uservoid
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontns_os_inituserinfo(const char *username) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (username == NULL)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        return;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    if (all_digits(username))
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        runas_pw = getpwuid((uid_t)atoi(username));
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    else
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        runas_pw = getpwnam(username);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    endpwent();
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (runas_pw == NULL)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        ns_main_earlyfatal("user '%s' unknown", username);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (getuid() == 0) {
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User            ns_main_earlyfatal("initgroups(): %s", strerror(errno));
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    }
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontvoid
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontns_os_changeuser(void) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (runas_pw == NULL || done_setuid)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        return;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    done_setuid = ISC_TRUE;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUXTHREADS
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    if (!non_root_caps)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        ns_main_earlyfatal(
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont           "-u not supported on Linux kernels older than 2.3.99-pre3");
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (setgid(runas_pw->pw_gid) < 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        ns_main_earlyfatal("setgid(): %s", strerror(errno));
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (setuid(runas_pw->pw_uid) < 0)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        ns_main_earlyfatal("setuid(): %s", strerror(errno));
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User}
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontvoid
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userns_os_minprivs(void) {
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUX_CAPABILITY_H
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#ifdef HAVE_LINUX_PRCTL_H
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    linux_keepcaps();
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    ns_os_changeuser();
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    linux_minprivs();
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#endif /* HAVE_LINUX_CAPABILITY_H */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontstatic int
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontsafe_open(const char *filename) {
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        struct stat sb;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        if (stat(filename, &sb) == -1) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont                if (errno != ENOENT)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont            return (-1);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        } else if ((sb.st_mode & S_IFREG) == 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        return (-1);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        (void)unlink(filename);
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User        return (open(filename, O_WRONLY|O_CREAT|O_EXCL,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User             S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH));
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User}
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontstatic void
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontcleanup_pidfile(void) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    if (pidfile != NULL)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        (void)unlink(pidfile);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    free(pidfile);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    pidfile = NULL;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontvoid
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontns_os_writepidfile(const char *filename) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        int fd;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    FILE *lockfile;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    size_t len;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    pid_t pid;
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    /*
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont     * The caller must ensure any required synchronization.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User     */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    cleanup_pidfile();
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    len = strlen(filename);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    pidfile = malloc(len + 1);
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User    if (pidfile == NULL)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont                ns_main_earlyfatal("couldn't malloc '%s': %s",
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont                   filename, strerror(errno));
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    /* This is safe. */
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    strcpy(pidfile, filename);
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        fd = safe_open(filename);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        if (fd < 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User                ns_main_earlyfatal("couldn't open pid file '%s': %s",
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont                   filename, strerror(errno));
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        lockfile = fdopen(fd, "w");
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User        if (lockfile == NULL)
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont        ns_main_earlyfatal("could not fdopen() pid file '%s': %s",
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User                   filename, strerror(errno));
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#ifdef HAVE_LINUXTHREADS
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    pid = mainpid;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User#else
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    pid = getpid();
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont#endif
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        if (fprintf(lockfile, "%ld\n", (long)pid) < 0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User                ns_main_earlyfatal("fprintf() to pid file '%s' failed",
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont                   filename);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User        if (fflush(lockfile) == EOF)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User                ns_main_earlyfatal("fflush() to pid file '%s' failed",
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont                   filename);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User    (void)fclose(lockfile);
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontvoid
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupontns_os_shutdown(void) {
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    closelog();
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont    cleanup_pidfile();
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont}
7768b049c0b39662baca604ec32b32c6480f8dc6Francis Dupont